The current 2013-12-02 spec uses normalized module names
````
     loader.[[Loads]] and loader.[[Modules]] are both keyed by normalized module names.
````
However, I can't see how the .js bit plays here one way or another. Given an import with a 'name', the Loader will call both normalize() and locate() (was resolve). The result of the normalize step is an (opaque?) string used as a key and the result of the second step is an address (URL).  So the constraints are that everyone agree on names and URLs, but the normalized names are internal to the particular implementation of the Loader (System). Normalized names must mean the same as URLs however, since the locate() won't be called if the normalize name has been previously loaded. We could, I think, return URLs from normalize. The only difference between normalize() and locate() is that the arguments to normalize(name, refererName, refererAddress) vs locate(load) where load has load.metadata which we could attach when we create a load, eg where we set baseURL.

The appending .js bit is just a trivial implementation of locate(). Your example with cgi-bin falls under the part where the spec says:
````
NOTE
The browser's System.locate hook may be considerably more complex
````
This is also an example of where urlToName fits in: we need to create a name from  '/cgi-bin/foo.cgi?name=Erik'