Fix #28: Require a secure context

[mwatson2]

No description provided.

[domenic]

Please use current settings object, not incumbent settings object. We are trying to rid the platform of as many uses of incumbent settings object as possible. See https://readable-email.org/list/public-script-coord/topic/multiple-globals-and-you.

This also aligns with the advice in https://w3c.github.io/webappsec-secure-contexts/#new

[mwatson2]

If we do this, we will use the [SecureContext] annotation instead.