A spec for a CORS-like header that describes behaviour for mixed contexts