Deferred same origin check to CSP (closes #209)

* Added forced same origin check on start_url
* Deferred same origin check to CSP
* Letting HTML handle the fetching form the link element