SRI: Normatively reference Fetch.

As noted in [1], the Fetch modifications documented in this spec are
poorly cited. This patch adds a normative reference to the WHATWG's Fetch
specification, and cleans up some of the potentially unclear section
references by adding links.

Closes issue #15.

[1]: http://lists.w3.org/Archives/Public/public-webappsec/2014Mar/0059.html
SRI: Require user agents to send cache control headers.

This addresses issue #14, but adds no normative change to the
specification, as this requirement was already implicit in the
modifications made to the Fetch algorithm.
SRI: Note an issue with `srcset`.

Tracked on GitHub as issue #5.