[fetch] typo in no-cors credentials handling (#169)

Step 4.3 of HTTP fetch reads:

```
Let credentials flag be set if one of
 - request's credentials mode is "include"
 - request's credentials mode is "same-origin" and either the CORS flag is unset or
   response tainting is "opaque" 
```

That second bullet should read "or response tainting is NOT opaque".  The logic on the opaque check is reversed.

---
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/169