title: upgrade-insecure-requests directive works but a warning is displayed anyway
body: <p>I'm loading external content on my web site and I have no control on this content.
  My web site is served over HTTPS but some of the external URLs use HTTP.
  So I added the <code>upgrade-insecure-requests</code> policy.</p>
  
  <p>This works and I can see in the Chrome DevTools that all external resources are served over HTTPS.</p>
  
  <p>But recently I started getting this warning:</p>
  
  <p><a href="https://i.stack.imgur.com/ALYiG.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ALYiG.png" alt="enter image description here"></a></p>
  
  <p>Also, when such content is loaded, the little padlock on the left of the address bar is removed.</p>
  
  <p>Is this warning only there to tell me "<em>hey, I did my job but you should do something about those insecure URLs</em>" or is there something else I'm missing?</p>
  
  <p>NOTE: It works as expected with Firefox: HTTP becomes HTTPS, no warning and the padlock remains.</p>