Cannot compare origins without using "same origin"; couple permission with an origin

This partially addresses some points made in
https://www.w3.org/Bugs/Public/show_bug.cgi?id=27378 though is not yet
avoiding the document.domain bug.