Add TAO check

fetch.bs

@@ -3899,10 +3899,10 @@ optional <i>CORS flag</i> and <i>CORS-preflight flag</i>, run these steps:
     <p class="note no-backref">As the <a>CORS check</a> is not to be applied to
     <a for=/>responses</a> whose <a for=response>status</a> is <code>304</code> or <code>407</code>,
     or <a for=/>responses</a> from a service worker for that matter, it is applied here.
-  </ol>
 
- <li><p>If the <a>TAO check</a> for <var>request</var> and <var>response</var> returns failure, then
-  set <var>request</var>'s <a for=request>timing allow failed flag</a>.
+   <li><p>If the <a>TAO check</a> for <var>request</var> and <var>response</var> returns failure,
+   then set <var>request</var>'s <a for=request>timing allow failed flag</a>.
+  </ol>
 
  <li>
   <p>If <var>actualResponse</var>'s <a for=response>status</a> is a <a>redirect status</a>, then:
@@ -5092,7 +5092,7 @@ agent's <a>CORS-preflight cache</a> for which there is a <a>cache entry match</a
  <li><p>If <var>response</var>'s <a for=request>timing allow failed flag</a> is set, then return
  failure.
 
- <li><p>If <var>request</var>'s <a for=request>tainted origin flag</a> is unset and
+ <li><p>If <var>request</var>'s <a for=request>response tainting</a> is not "<code>basic</code>" and
  <var>response</var>'s <a for=response>location URL</a>'s <a for=url>origin</a> is
  <a>same origin</a> with <var>request</var>'s <a for=request>origin</a>, then return success.