This change is editorial.

Tracking bug: whatwg/html#1430

- Clarify which active document's origin is tested for same origin-domain-ness
- Use 'relevant settings object' over 'current settings object' where applicable
- Update 'allowlist' to match the convention
- Use WHATWG HTML references (except for firing a simple event that's gone)
- Fix typos

Fix #19

- Use 'allowed to use' as a condition for rejection, move the old
  text to a note
- Align Feature Policy integration section with the latest prose
- Fix allowlist notation

Note it is possible to explicitly grant access to cross-origin
subframes using feature policy, in which case the promise is
not rejected.

Error message:
Couldn't match "EventTarget" to anything in the document or in any
other document cited in this specification: webidl

…ttery into issue-10-secure-top-level