Initial version of the same-origin policy model in Alloy

This initial version contains Alloy models of:
* client-server model with HTTP 
* the same origin policy
* the cross-origin sharing 
* security property

To add for the future versions:
* model documentation
* JSONP
* PostMessage
This may be obvious to anyone with a stronger background in internet security, but to a relatively inexperienced reader I'm having trouble understanding: how does a hacker's request body becomes a response to the trusted browser. Could this be expanded on?