Prevent attempted cross-domain navigation (experimental).

For now, guard the new logic behind a `experimental-same-origin` config.

Progress on #30.
Definitely going to add the CORS whitelist; added the TODO.