Prevent attempted cross-domain navigation (experimental).

For now, guard the new logic behind a `experimental-same-origin` config.

Progress on #30.