SI: Get more specific in XHR 'progress' event blockage.
SI: Non-CORS requests can't use CORS headers for eligibility.
SI: Cleanup 'link' and 'script' element.
SI: Tweaks to caching.

1. Caching is explicitly optional.
2. Caching in the context of CSP requires nonces for script and style.
SI: s/CORS same-origin/same origin/g
SI: Regenerate.