Re: [fetch] CSP Request Header and CORS preflight fetch. (#52)

I see three problems. 1. It's not clear when this header is supposed to be set and therefore it's not clear whether e.g. service workers are supposed to be able to observe it. 2. This header can be set by `fetch()` and `XMLHttpRequest` because it is not prefixed with `Sec-` so you need to handle duplicates somehow when you set it. 3. It's not clear whether including this header cross-origin is a security risk or not and therefore whether we should preflight it. So far we have answered yes to this question.

---
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/52#issuecomment-102905430