Fix crossorigin attribute logic for Safari

[rtsao]

Turns out script.src and script.getAttribute('src') yield different results for relative sources, which made the logic faulty. script.src yields an absolute URL whereas script.getAttribute('src') yields the relative URL.

Fixes #314

The existing test had a false negative because tests are served via http:// instead of https://. The new implementation avoids this pitfall.

[KevinGrandon]

indexOf() will return a 0 if it starts at the beginning, so should we compare with -1 instead?

[rtsao]

That's actually how it's intended to work.

When expanded, the logic looks something like this:

var isSameOrigin = script.src.startsWith(window.location.origin);
// equivalent to:
var isSameOrigin = script.src.indexOf(window.location.origin) === 0;
// equivalent to:
var isSameOrigin = !(script.src.indexOf(window.location.origin) !== 0);
// equivalent to:
var isSameOrigin = !(Boolean(script.src.indexOf(window.location.origin)));
// equivalent to:
var isSameOrigin = !(script.src.indexOf(window.location.origin));

if (isSameOrigin) {
  removeCrossOriginAttribute();
}

I picked the smallest implementation (excluding startsWith because that would require polyfills) since it's going directly into the webpack bootstrap code and assigning variables, etc. is probably a bad idea. Also I don't think Uglify will be able to perform the simplification above.

[lhorie]

Maybe add a comment then?

[rtsao]

There's already a fairly extensive comment above that describes what this plugin does and why it is necessary. With that context, I don't think there should be any confusion.