Tutorial should mention a security policy file

[TimSylvester]

Depending on target/min API version, the usesCleartextTraffic attribute in the manifest may not work, and a security policy file should be used instead:

Manifest:

<application
      ...
      android:networkSecurityConfig="@xml/network_security_config">
      ...
</application>

res/xml/network_security_config.xml:

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config cleartextTrafficPermitted="true">
        <!-- Maply tile loading -->
        <domain includeSubdomains="false">[tile.stamen.com](http://tile.stamen.com/)</domain>
    </domain-config>
</network-security-config>