Add support for upgrade insecure requests

[marcoscaceres]

@yoavweiss said:

Can we add https://w3c.github.io/webappsec/specs/upgrade/ to make sure this doesn't happen again with some other resources? (in supporting browsers)

And I believe we can :)

[marcoscaceres]

It's also an excuse for me to read the spec.

[anselmh]

Do we need this now as we have upgraded all URLs already to https?

[marcoscaceres]

it will help us avoid problems in the future.