[w3c/browser-payment-api] "allowed to use" check is incorrect (#363)

PaymentRequest constructor, step 3.3, says:

> If any ancestor browsing context of context has an active document with an origin that is not the same as origin and context's browsing context container's node document is not allowed to use the feature indicated by attribute name allowpaymentrequest, then throw a SecurityError. 

So this will check whether the _parent_ document is allowed to use the feature.  Shouldn't we be checking whether _this_ document is allowed to use the feature?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/browser-payment-api/issues/363