[fetch] Navigate likely needs to be "no-cors" after all, need to update security checks (#126)

The reason navigate needs to be "no-cors" is due to the Origin header. We cannot just override the origin to always be same-origin, because that would give the wrong value for the Origin header. And I don't think we want to introduce a second origin concept.

---
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/126