Module isn't fetched with credentials

[Rich-Harris]

In my current case, I'm building an app behind an IAP interstitial, but this will no doubt also apply to some cases where assets are hosted on a separate domain to the app itself once we get round to #437, whatever form it takes.

Sapper writes this code to the page:

try{
  new Function("import('/client/client.939216c0.js')")();
}catch(e){
  var s=document.createElement("script");
  s.src="/client/shimport@0.0.11.js";
  s.setAttribute("data-main","/client/client.939216c0.js");
  document.head.appendChild(s);
}

When IAP is involved you have to pay for everything with a cookie. Regular script tags are fine, but modules are not. Since there's currently no way to use credentials with import(...), that presumably needs to become something like this:

var s=document.createElement("script");
try{
  new Function("if(0){import('')}")();
  s.type='module';
  s.crossorigin='use-credentials';
  s.src='/client/client.939216c0.js'
}catch(e){
  s.src="/client/shimport@0.0.11.js";
  s.setAttribute("data-main","/client/client.939216c0.js");
}
document.head.appendChild(s);