Comment by jwatte

Unfortunately, most of these web security standards don't work for real sites. When my app server serves a page that uses services from another subdomain, this breaks. When I use a CDN to cache contents, this breaks. When I terminate HTTPS and web auth at a reverse proxy and forward the request to a HTTP server, the proxy needs to know about all decisions the app server would make about origins. (The exact reasons get complex, but most of these origin policies are /not/ friendly to non-trivial site deployments)