Agreed, couldn't "I hereby relinquish my ability to bring other-origin content into this process without their opt-in" be a JS API call (one-way)? HTTP headers

Agreed, couldn't "I hereby relinquish my ability to bring other-origin content into this process without their opt-in" be a JS API call (one-way)? HTTP headers should not affect app functionality in this way.