Editorial: mention the tainted origin flag less

Closes #953.

Author: annevk

fetch.bs

@@ -3093,8 +3093,9 @@ Cross-Origin-Resource-Policy     = %s"same-origin" / %s"same-site" ; case-sensit
 
   <p class="note no-backref">While redirects that carry  a
   `<a http-header><code>Cross-Origin-Resource-Policy</code></a>` header are checked, redirects
-  without such a header resulting in <var>response</var> do not contribute to this algorithm. I.e.,
-  <var>request</var>'s <a for=request>tainted origin flag</a> is not checked.
+  without such a header resulting in <var>response</var> do not affect the outcome as the default is
+  <b>allowed</b>.
+  <!-- This changes with COEP's cross-origin value. -->
 
  <li>
   <p>Let <var>policy</var> be the result of <a for="header list">getting</a>
@@ -3975,10 +3976,9 @@ optional <i>CORS-preflight flag</i>, run these steps:
 
  <li><p>If <var>request</var>'s <a for=request>mode</a> is "<code>cors</code>",
  <var>actualResponse</var>'s <a for=response>location URL</a>
- <a lt="include credential">includes credentials</a>, and either <var>request</var>'s
- <a for=request>tainted origin flag</a> is set or <var>request</var>'s <a for=request>origin</a> is
- not <a>same origin</a> with <var>actualResponse</var>'s <a for=response>location URL</a>'s
- <a for=url>origin</a>, then return a <a>network error</a>.
+ <a lt="include credential">includes credentials</a>, and <var>request</var>'s
+ <a for=request>origin</a> is not <a>same origin</a> with <var>actualResponse</var>'s
+ <a for=response>location URL</a>'s <a for=url>origin</a>, then return a <a>network error</a>.
 
  <li>
   <p>If <var>request</var>'s <a for=request>response tainting</a> is "<code>cors</code>" and