Upgrade: Drop the 'upgraded' signal, expand the 'https' signal.

Upgrade: Drop the 'upgraded' signal, expand the 'https' signal.

Based on further conversation, we're dropping the 'Upgraded' header
entirely, and expanding the 'HTTPS' header (nee 'Prefer: tls') to
cover hosts that haven't opted-into preloadable HSTS[1].

[1]: https://github.com/w3c/webappsec/commit/f8a1183b014697c918e26c80df0523a977dc3a9e

BUG=455674
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=192260

[Mike West, 2015-03-20 13:51:02]

mkwst@chromium.org changed reviewers:
+ yoav@yoav.ws

[Mike West, 2015-03-20 13:51:02]

Hi Yoav. You're going to LOVE this CL.

[Yoav Weiss, 2015-03-20 14:18:10]

On 2015/03/20 13:51:02, Mike West wrote:
> Hi Yoav. You're going to LOVE this CL.

LGTM.

Didn't follow the discussion since I spent a large chunk of my time moving
between continents and blabbing about images. 
Can you just get me up to speed on it? We wound up with shorter on-by-default
headers? What happened to the "I need to know if a browser was upgraded or the
user typed in https" use case?

[Mike West, 2015-03-20 14:32:20]

On 2015/03/20 at 14:18:10, yoav wrote:
> On 2015/03/20 13:51:02, Mike West wrote:
> > Hi Yoav. You're going to LOVE this CL.
> 
> LGTM.
> 
> Didn't follow the discussion since I spent a large chunk of my time moving
between continents and blabbing about images. 

What? You mean to tell me that you haven't been following the Most Important
Conversation on the Internet(tm)?!?!

> Can you just get me up to speed on it? We wound up with shorter on-by-default
headers? What happened to the "I need to know if a browser was upgraded or the
user typed in https" use case?

Yes. `HTTPS: 1` is shorter, and on everywhere except hosts that have opted into
"preloadable HSTS"
(https://w3c.github.io/webappsec/specs/upgrade/#preloadable-hsts-host). This
kinda sucks, but I haven't been able to come up with another mechanism of
serving both the HTTP->HTTPS upgrade case, and the HTTPS->HTTP downgrade case.

The "preloadable" carveout works because we assume that `preload` is an
assertion that the upgrade mechanism isn't essential on the site, and that it
can therefore unconditionally redirect users from HTTP to HTTPS. That's not
implemented in this CL because we have no mechanism at the moment for piping a
host's HSTS status down into Blink.

Guess what one of my future CLs is going to do?

[Mike West, 2015-03-20 14:32:35]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2015-03-20 14:32:52]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1022093002/1

[commit-bot: I haz the power, 2015-03-20 16:01:22]

Committed patchset #1 (id:1) as
https://src.chromium.org/viewvc/blink?view=rev&revision=192260