Change default of request's credentials mode

[annevk]

This only affects specifications that do not set credentials mode and I'm not aware of any.

Closes #804.

---

Preview | Diff

[domenic]

Many parts of HTML fail to set credentials mode, I think? E.g. a bunch of navigation ones:

Let resource be a new request whose url is url and whose referrer policy is the current state of element's referrerpolicy content attribute.

If destination is not a request, then set destination to a new request whose URL is destination.

Plan to navigate to a new request whose url is parsed action, method is method, header list consists of Content-Type/MIME type, and body is body.

Let request be a new request whose URL is urlRecord.

(and more I skipped over)

importScripts():

Let request be a new request whose url is url, client is settings object, destination is "script", parser metadata is "not parser-inserted", synchronous flag is set, and whose use-URL-credentials flag is set.

Downloads:

Let request be a new request whose url is URL, client is entry settings object, initiator is "download", destination is the empty string, and whose synchronous flag and use-URL-credentials flag are set.

I also found service worker script imports:

Let importRequest be a new request whose url is importUrl, client is job’s client, destination is "script", parser metadata is "not parser-inserted", synchronous flag is set, and whose use-URL-credentials flag is set.

[annevk]

None of those should use "omit".

[domenic]

Sure, I wasn't really questioning the change, just the commit message. Although it might be worth using this opportunity as a forcing function to fix HTML, at least.

[annevk]

What would we want in HTML? Set credentials mode less I suppose as the default already handles it?

[domenic]

Well navigate (and downloads?) seems like it should always be include? We could force that inside the navigate algorithm, but that seems hacky; I'd almost prefer updating all the call sites then adding an assert inside the navigate algorithm.

I'm honestly not sure what browsers do for importScripts(). If it's same-origin then omitting it seems OK I guess.

Alternately we could try to remove the default entirely and make all callers consider this? Hmm, not sure...

[annevk]

Oh right, yeah, some of those need "include", at which point that would be a pretty significant undertaking with regards to tests. I don't want to take that on right now.