Test the javascript: URL security check

[domenic]

Follows whatwg/html#6801.

[annevk]

I don't understand the expectations for the case where one side sets document.domain. document.domain does not influence the same origin check. It only influences same origin-domain. So browsers that fail that test would be doing the same origin check, right?

It might be good to also test what happens with same-site cross-origin and both sides setting document.domain.

[domenic]

You're right that the expectations didn't match the spec. I updated the spec though so I think the tests are now good.

It might be good to also test what happens with same-site cross-origin and both sides setting document.domain.

Done.

[annevk]

Thanks!