Sites shouldn't use the unsafe-url plan, as this could induce HTTPS URLs for being exposed on the wire in excess of an HTTP connection, which defeats one of many vital privacy and security guarantees of HTTPS. This may be a disincentive to migrate to HTTPS, mainly because it deprives connected http://XXX