Bug 839867 - Align gecko with the spec on cross-origin access to Location.hash. r=bz

We update the tests to cover this case. There was also a bug in the tests where
we were accidentally testing non-writable Location properties against window
rather than window.location. :-(