Get proper same-origin behaviour when loading modules

Get proper same-origin behaviour when loading modules

The browsers currently do not default to same-origin behaviour for
modules, so we need to be explicit in order for necessary
credentials to be passed along. This seems to be changing though,
but we need to wait for the browsers to actually roll out more
lenient defaults:

https://github.com/whatwg/fetch/pull/585