Do not doubt a secure (i.e. validated) NXDOMAIN response when we just

Do not doubt a secure (i.e. validated) NXDOMAIN response when we just
switched networks. We validated it, we can't do better than that!

While here reorder the long list of conditions to make it easier to
understand when we doubt a response because we might be behind a
captive portal. First list all conditions when we do not doubt the
response and then the two conditions when we do doubt the response.

OK benno