At least on Chrome for Android, it seems that getting the device orientation is not allowed on HTTP. It means that CardboardVR on HTTP isn't working.
In that case, if the fallback of the device is CardboardVR and the page is insecure, I think that it'll be better if there was a console error while loading the page, and the "immersive-vr" session shouldn't be supported.
The error message could be something like "Can't fallback to CardboardVR on insecure context".
At least on Chrome for Android, it seems that getting the device orientation is not allowed on HTTP. It means that CardboardVR on HTTP isn't working.
In that case, if the fallback of the device is CardboardVR and the page is insecure, I think that it'll be better if there was a console error while loading the page, and the "immersive-vr" session shouldn't be supported. The error message could be something like "Can't fallback to CardboardVR on insecure context".