F.open() doesn't throw when violating same-origin

[matthewp]

You can't, for example, load google.com from localhost. This fails, but does so silently.

We do catch the error in a try/catch here. We could improve this by checking the error in the catch and if it is a SecurityError, rethrow so the user can see the error.

Chrome and Firefox give a different error message, so detecting this might be tricky.