Deferred same origin check to CSP (closes #209)

* Added forced same origin check on start_url
* Deferred same origin check to CSP
* Letting HTML handle the fetching form the link element
Merge pull request #219 from w3c/same_origin

Deferred same origin check to CSP (closes #209)