whitelisted mixed content pages incorrectly showing as secure in private browsing mode

[diracdeltas]

to repro:

1. go to https://mixed-script.badssl.com/ in a regular browsing session and allow mixed content
2. open a private tab and go to the same URL

expected behavior:
the private tab shows the unlocked icon

actual behavior:
the private tab shows the locked icon even though insecure scripts are loaded

cc @darkdh

[diracdeltas]

actually this same bug happens even if the mixed content is allowed in the private browsing tab instead of in the regular tab