Ignore blank origins in the Security panel.

Source/devtools/front_end/sdk/NetworkManager.js

Index: Source/devtools/front_end/sdk/NetworkManager.js
diff --git a/Source/devtools/front_end/sdk/NetworkManager.js b/Source/devtools/front_end/sdk/NetworkManager.js
index 29ab862de358d7f186b0d3d951041954ed03252a..fdcf470bf74af88d898f0d959e5681eeff55cd99 100644
--- a/Source/devtools/front_end/sdk/NetworkManager.js
+++ b/Source/devtools/front_end/sdk/NetworkManager.js
@@ -362,9 +362,15 @@ WebInspector.NetworkDispatcher.prototype = {
      */
     _dispatchResponseReceivedSecurityDetails: function(requestId, response)
     {
+        var origin = WebInspector.ParsedURL.splitURLIntoPathComponents(response.url)[0];

[dgozman, 2015/09/03 21:01:16]

Side note: do you need to include port here? If so, there is ParsedURL.domain()
function.

+        if (!origin) {
+            // We don't handle resources like data: URIs. Most of them don't affect the lock icon.
+            return;
+        }
+
         var eventData = {};
         eventData.requestId = requestId;
-        eventData.origin = WebInspector.ParsedURL.splitURLIntoPathComponents(response.url)[0];
+        eventData.origin = origin;
         eventData.securityState = response.securityState;
         if (response.securityDetails) {
             /**