Rewrite algorithm to handle sandboxes inside 'http://127.0.0.1/'

bzbarsky@ noted in #26 that the current algorithm
does a poor job handling sandboxed contexts inside non-HTTPS secure contexts.
That is, 'about:blank' inside 'file:///usr/local/whatever' would not be
considered a secure context, as its 'HTTPS State' won't be 'modern'. The
rewrite in this patch drops the dependency on 'HTTPS State', and examines
the origin and URL instead, as appropriate.