[fetch] RequestCredentials "same-origin" does not work in "no-cors" mode (#130)

Currently the spec says the following in step 3.3 of Http Fetch:

> Let credentials flag be set if either request's credentials mode is "include", or request's credentials mode is "same-origin" and the CORS flag is unset, and unset otherwise. 

This does not work in "no-cors" mode, however, because the CORS flag will never be set.  We should consider language like:

> Let credentials flag be set if any for any of the following conditions and unset otherwise.
> * request's credentials mode is "include"
> * request's credentials mode is "same-origin" and the CORS flag is unset
> * request's credentials mode is "same-origin" and the response tainting is currently opaque

---
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/130