Anyone what the "security metrics" they referenced in the commit message were that they thought would be impacted by making this unrequested change to how the web works?