Skip CORS checks when preflight is only for PNA

[johnathan79717]

Fixes #116.

[annevk]

This makes some sense, but it doesn't seem acceptable to define it like this long term. I suspect the model is something like this:

1. No preflight.
2. CORS preflight.
3. PNA preflight.
4. PNA + CORS preflight combined (as sending two separate preflights would be wasteful).

I suspect what we want is a single PNA-and-CORS-preflight fetch to replace the existing CORS-preflight fetch and that takes a mode parameter of sorts which enforces which headers get added and such.

And that will also require quite extensive changes to the CORS protocol section as now it's the PNA + CORS protocol.

[iVanlIsh]

The changes make sense to me. However, I would suggest asking some preflight/CORS experts and see if we really need to make PNA preflight into a new and different protocol. IMHO, the difference between CORS and PNA is not big enough to make them into two separate stuff.