This test loads a secure iframe that has a form with an insecure action. We should *not* get a mixed content callback because the main frame is HTTP and the form doesn't contaminate the child iframe's security origin with mixed content.