Subject: [Unbearable] API requirements

From: Martin Thomson <[email-masked]>
Date: Wed, 8 Jul 2015 14:32:50 -0700

What do we believe the API requirements to be for this?

If this just the equivalent of "Include-Referer-Token-Binding-ID",
which I think was considered sufficient, we still need to consider the
secondary consequences.  Here's a short list of questions that I could
devise off the cuff:

Are there any reasons for this to be set when the request mode is
"same-origin"?  (I think that there are, but I'd like to be clear on
this.)

What limitations should this have with respect to the credentials
modes that it can be used with?

Does this cause the force Origin header field flag to be set?

Of course, we could instead decide on the principles that need to be
followed and clearly articulate those.  I'm not sure what those are.