Move 401/407 to HTTP-network-or-cache fetch

[annevk]

And with that I guess the CORS check since this would require passing the CORS flag along.

The reason being that 401/407 responses that cause a subsequent request are purely a network affair. Service workers should not be able to cause that subsequent request and should never get a fetch event for it. The easiest way to guarantee that is by simply making them network-only.

Realized this while going through w3c/ServiceWorker#793.

[jungkees]

One check point is service workers still can return a synthetic response with 401/407. So, it seems HTTP fetch step 3.3.3 should consider that response as a network error?

[annevk]

No, we'd just return it to whoever asked. Let them handle it.

[jungkees]

Agreed.