Prevent attempted cross-domain navigation (experimental).

For now, guard the new logic behind a `experimental-same-origin` config.

Progress on #30.
I like the idea of a cors whitelist. Even if you don't want to put it in this change, a TODO is probably worthwhile..