If there's security concerns then it should prompt the user to allow/deny as well as whitelist the site for the future with a setting that lets people disable WebRTC easily (not in some obscure area).