Fetch should handle 'X-Frame-Options'

[mikewest]

Probably around the same place as the other response checks at the bottom of the main fetch algorithm, though browser behavior diverges a bit with regard to whether or not a navigation actually takes place, whether an error page is rendered, etc.

There's also some strangeness around the content-disposition header that bit us when we moved XFO up out of blink into Chrome's browser process: see https://crbug.com/610284 That header doesn't show up in Fetch either, though I'm not really sure it ought to?

[annevk]

Should this perhaps be handled in HTML's navigate algorithm? Or does it have meaningful impact on all responses?

[annevk]

HTML has some special casing around Content-Disposition by the way, for downloads, though it's not as clearly layered as it should be.

[mikewest]

Putting it into HTML's navigate makes sense. If we're doing that, then we probably should do the same for CSP's frame-ancestors, which are currently specified as a response check. I'll close this out and file the same bug against HTML. :)