[Bug 23606] Returning null when "the resource is CORS-cross-origin" seems wrnog

Remove the sentence from the spec since the CORS check is
already performed by the fetch algorithm with "potentially CORS-enabled fetch" mode
which returns null for non-CORS cross origin access.