[manifest] Must manifests be same-origin? (#360)

https://w3c.github.io/manifest/#obtaining step 3 says 

> If the URL of _manifest link_'s `src` attribute is not same origin as its owner `Document`, then … terminate this algorithm.

However, https://w3c.github.io/manifest/#content-security-policy says

> The `manifest-src` and `default-src` directives govern the origins from which a user agent can fetch a manifest.

Which is it?

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/360