Contradictory security statement

[marcoscaceres]

The spec states that "The feature is only available in first-party contexts.", but then adds a permission policy that invalidates this by making the API available in third-party contexts?

[anssiko]

Thanks for spotting this bug. It looks like "by default" was missing. Fix #178

I noticed "first-party context" concept is not defined by this spec (not a dfn) and is not defined (or not exported) by any other spec. Should that concept be defined here so we could link to it from within this spec? Or should we reconstruct it using the existing concepts defined by other specs? (This would be a separate issue.)