Consider a firewalled network with the high-level requirement that normal web browsing should work, but nothing else (e.g. ssh and skype are forbidden). (Incoming connections are denied as a matter of course.)
What should be done to HTTP CONNECT traffic? At one extreme, it could allow everything through, which would make the firewall ineffective. At the other extreme, it could be blocked: would this completely block HTTPS? (Assume the firewall is not going to play man-in-the-middle hoping that clients wouldn't notice the fake certificates.)
In other words, what is the practical “normal” use of CONNECT, and what is a good approximation of restricting its use to the “normal” cases?