Update on Chrome's WebVR policy regarding secure origins.

I know that this has been a topic of intense interest in the community, and
so although it's early we wanted to share an overview of the Chrome VR and
Security team's current plan for WebVR in relation to HTTP and HTTPS
domains.

On all domains we're planning on having some UI that displays the current
domain and security indicators when you enter VR. On HTTPS domains that UI
will fade out after a moment. On HTTP domains some form of the UI will
persist for the entirety of the VR session. We're still working on the
exact design of the UI but we're being careful to take into consideration
comfort, readability, and ensuring it doesn't permenantly obscure parts of
the scene. We'll share more as we become more confident about the design.

Thank you to everyone in the community that has worked with us to help
understand your various use cases. It's been invaluable to informing this
decision. And thank you for demonstrating how passionate this fledgling
community is about VR on the web! It's been encouraging to see, as one post
noted, just how many people give a damn. :)

--Brandon