In step 3 of the "Starting a presentation" algorithm, it only defined the behavior if one presentation URL is assigned. Below are the two possible solutions:

1. If the result of the algorithm is "Prohibits Mixed Security Contexts" and any of the presentationUrls is an a priori unauthenticated URL, then return a Promise rejected with a SecurityError and abort these steps
2. If the result of the algorithm is "Prohibits Mixed Security Contexts" and all of the presentationUrls are a priori unauthenticated URL, then return a Promise rejected with a SecurityError and abort these steps. Otherwise exclude those URLs that are a priori unauthenticated URL from presentationUrls and continue the algorithm.