Remove non-TLS support

server.py

@@ -11,13 +11,13 @@ Beyond serving files it has three jobs.
 
 The first is the boot page. The pages here are fragments and the shell around
 them is a template, so a browser asking for one directly would get a bare
-fragment with no chrome. Navigations are answered with boot.html, which loads
-the same renderer the service worker uses, composes the page that was asked
-for, and replaces itself with it -- so a first visit is the real app at the
-real URL, with no reload. Requests the worker and htmx make are ordinary
-fetches rather than navigations, so they pass straight through and get the
-fragment. Once a worker is installed it intercepts the navigation first and
-composes it there, and this page is not reached at all.
+fragment with no chrome. Navigations are answered with boot.html instead, which
+registers the service worker and reloads once it is running -- landing on the
+real app at the address that was asked for. Requests the worker and htmx make
+are ordinary fetches rather than navigations, so they pass straight through and
+get the fragment. Once a worker is installed it intercepts the navigation
+first and composes it there, and this page is not reached at all: it is seen
+once per device.
 
 The second is stamping the service worker. A browser only notices a new worker
 when the bytes of sw.js change, so something has to record what is on disk.
@@ -30,11 +30,12 @@ The third is cache headers: the worker owns the offline copy, and if the
 worker or the boot page that registers it are served stale, a new version can
 never reach a device that already installed the old one.
 
-Expects to sit behind something that terminates TLS. Without it the app still
-works -- boot.html composes every page in the browser -- but there is no
-offline copy: browsers only register a service worker in a secure context, and
-the bookmark lives in that worker, so over plain http:// from a LAN address the
-app reads online-only and the bookmark slot stays empty.
+Expects to sit behind something that terminates TLS, and does not work without
+it. Every page is composed by the service worker, browsers only register one in
+a secure context, and boot.html has no fallback that builds a page without one
+-- so over plain http:// from a LAN address the boot page says it could not
+install and stops there. localhost is a secure context, which is why running
+this directly for development still works.
 """
 
 from __future__ import annotations
@@ -235,8 +236,9 @@ class Handler(SimpleHTTPRequestHandler):
             self.send_header("Cache-Control", "public, max-age=604800")
         # One URL, two bodies: a navigation to /GEN gets the boot page and a
         # fetch of it gets the fragment. Without this the browser cache keeps
-        # one entry for both, and boot.html asking for its own fragment is
-        # handed back a copy of itself -- a document nested inside a document.
+        # one entry for both, and the worker asking for the fragment it is
+        # about to compose is handed back the boot page instead -- which is a
+        # document nested inside a document, or a spinner where the text goes.
         self.send_header("Vary", "Sec-Fetch-Mode")
         # Lets the worker claim the whole origin even if it moves off root.
         self.send_header("Service-Worker-Allowed", "/")