POD provider Origin also trusted by default?

[kjetilk]

The error message in EFForg/privacybadger#2240 (comment) made my think about the following: May it be that a apps on user's POD on a multiuser setup, e.g. https://testpb.dev.inrupt.net/ will not only load from self, but also from the Provider's https://dev.inrupt.net/ ? In which case the latter should also be trusted by default?

[kjetilk]

So, indeed, according to @dmitrizagidulin there are things running from the serverUri Origin, so we should concat that too.