In order to follow an insecure or "unsafe" link in VM, the user must currently use the prefix argument before launching the URL. I.e., she must type C-u ENTER while the cursor is overtop the link.
This behavior is fine, but I saw the following thread on the GNU Emacs-Devel list recently in which the developers are considering using the same key combination differently with regard to links: http://lists.gnu.org/archive/html/emacs-devel/2013-12/msg00438.html If adopted, it looks as though this proposed feature--which I actually rather like--may create a conflict, or at least a contextual difference in how links are treated, between VM and other Emacs modes. I thought it might be good to make a note of this possibility while it's still on the horizon, rather than after it's implemented. Cheers, Josh P.S. I'm not the same "Josh" commenting on the Emacs-Devel thread, lest there be any confusion.