The platform has settled on using the Fetch model to define fetching. CSS currently hand-waves a bunch of this, and as a result there are some browser-compat issues with corner cases, like what referrer to use in various situations.

WebAppSec defines some of this behavior for us (and here), which we should move into a CSS spec.

(This is mostly a tracking bug to remind me to do this, and track links to useful resources. If anyone else clueful would like to help, feel free.)