Restrict application caches to secure contexts

Fixes #3440.

Author: annevk

source

@@ -78127,7 +78127,7 @@ interface <dfn data-export="" data-dfn-type="interface">Window</dfn> : <span>Eve
 
   // the user agent
   readonly attribute <span>Navigator</span> <span data-x="dom-navigator">navigator</span>; <!-- IE also has window.clientInformation === window.navigator -->
-  readonly attribute <span>ApplicationCache</span> <span data-x="dom-applicationCache">applicationCache</span>;
+  [SecureContext] readonly attribute <span>ApplicationCache</span> <span data-x="dom-applicationCache">applicationCache</span>;
 
   // user prompts
   void <span data-x="dom-alert">alert</span>();
@@ -86014,7 +86014,8 @@ NETWORK:
 
   <h4>Application cache API</h4>
 
-  <pre><code class="idl" data-x="">[Exposed=Window]
+  <pre><code class="idl" data-x="">[SecureContext,
+ Exposed=Window]
 interface <dfn>ApplicationCache</dfn> : <span>EventTarget</span> {
 
   // <span data-x="concept-appcache-status">update status</span>
@@ -106149,7 +106150,9 @@ document.body.appendChild(text);
     this element in the <span>stack of open elements</span>.</p>
 
     <p id="parser-appcache">If the <code>Document</code> is being loaded as part of <span
-    data-x="navigate">navigation</span> of a <span>browsing context</span>, run these steps:</p>
+    data-x="navigate">navigation</span> of a <span>browsing context</span> and the result of
+    executing <span>Is environment settings object a secure context?</span> on the
+    <code>Document</code>'s <span>relevant settings object</span> is true, then:</p>
 
     <ol>