[XHR] Comments on the latest public working draft

Hello,

Sorry if this was asked already but:

- Why doesn't a redirect that violates the security restrictions throw 
SECURITY_ERR, instead of NETWORK_ERR?

- On the send algorithm, step 4 ("If stored method is GET act as if the 
data argument is null"), why only GET and not HEAD, also?

Thanks,
Sergiu Dumitriu