Haketilo

allow injected scripts to bypass CORS using provided API

delay loading of js code in test_policy_enforcing.py

We don't want JS loading to happen upon python module load. We want to do it lazily. Here it was being done eagerly due to some previous overlooking.

prepare for exposing APIs to injected scripts

serialize and deserialize entire Response object when relaying fetch() calls to other contexts using sendMessage

don't double-modify response headers retrieved from cache

improvement to also properly sanitize intrinsics in XML documents under older browsers (IceCat 60)

present appropriate error message when using popup in Private Browsing mode

correct the Private Browsing mode notice on settings page

improve script blocking in non-HTML documents (XML)

fix setting of 'blocked-blocked<...>-' attributes and add tests