https://www.eff.org/deeplinks/2008/06/osp-best-practices