Add preload and prerender contexts

[igrigorik]

Current list of contexts contains prefetch but omits prerender and preload, which need to be added to the list. I'm thinking...

• preload -> connect-src (see (WIP) Remove loadpolicy attribute w3c/preload#17 (comment))
• prefetch -> no CSP policy? Is there a reason? Should it be connect-src as well?
• prerender -> intuitively, seems that it should be the same as prefetch.

/cc @yoavweiss @mikewest

[annevk]

It seems they should be governed by CSP somehow, otherwise you can "escape the page" without performing navigation. (Unless these are same-origin restricted?)

[annevk]

Also, to be clear, that big table is informative and not normative about what CSP will do. CSP will be rewritten in terms of Fetch in due course and then this should be a lot clearer.

[annevk]

Closing this. CSP alignment will come when @mikewest fixes CSP to use Fetch.

[igrigorik]

@annevk sorry missed the earlier commit. Thanks for adding preload/prerender!

One gotcha that I was reminded after opening this bug: connect-src is not the right policy for preload. See: w3c/preload#17 (comment)... We should probably leave it as empty for now, at least until we resolve our "as" exploration.

[annevk]

Done.

[igrigorik]

thanks!