Prevent attempted cross-domain navigation.

Promote previous `experimental-same-origin` logic to be always enabled.

Closes #30.