Provide the details of how sourceOrigin argument of cookie commands should be validated

[lutien]

At the moment, the spec doesn't provide a clear guidance of how sourceOrigin argument of cookie commands should be validated, or if the protocol implementation can/should do any preprocessing (e.g. extracting an origin from URL), that might result in the different behavior across implementation.