start_url should not default to document URL

[mgiuca]

As discussed in #668, the current default for start_url is the document URL (the page that referred the user agent to this manifest). That isn't very satisfactory, for a few reasons:

1. It means the app will behave differently depending on which page you installed it from.
2. It means a manifest cannot be interpreted without some document URL pointing at it. This is meaningless when a web app is installed directly through some external means (such as the Microsoft Store), because there was no containing document.

Furthermore, Google Chrome does not let the app be installed if start_url is omitted (in violation of the spec).

In order to make the interpretation of the manifest a function of only the manifest (and not dynamic factors like "what page the user was on when they installed this app"), the start_url default needs to change, to either:

1. Nothing, making start_url mandatory, or
2. / (the root of the site), or
3. . (the containing directory of the manifest). I think this makes the most sense, because then a manifest "/myapp/manifest.json" has a default start URL of "/myapp/" and a default scope of "/myapp/".

While . makes the most sense, it breaks forwards-compatibility with current implementations (new manifests taking advantage of the new default will not work in current-generation user agents). Making it mandatory seems the most compatible option.

However, I noticed this line in the spec:

Please note that the start URL is not necessarily the value of the start_url member: the user or user agent could have changed it when the application was added to home-screen or otherwise bookmarked.

So that makes it a little awkward to make start_url mandatory, if technically it is a "hint" which the UA can ignore. I still think it makes sense for it to be mandatory that the site supply a "default" start_url, even if the user or user agent can override it.

[marcoscaceres]

No a big fan of making it mandatory... will chew on it.

[mgiuca]

OK I renamed the title since there isn't consensus on what the solution is (but I think we agree on the problem).

I've uploaded a patch at #670. There are issues with making start_url have no default value. It would actually be much more straightforward if we gave it a proper default (either / or .). As I said above, that breaks forwards-compatibility but it might be worth doing. (It would just mean that any site relying on it would not be installable in old versions of Chrome.) I'm happy to have that.

[mgiuca]

Discussed with @marcoscaceres and @dominickng : the new "document is installable" logic gives us a path forward on this:

1. If start_url is not supplied or invalid, just leave it as undefined (so there's no default).
2. Move the "start_url is same origin as document URL" check up to steps to determine installability of the document. If start_url is missing or not same origin as document URL, document is not installable.

Resolves #668 and #669.