We shouldn't use "omit" as a default. We should use "same-origin" for web developer convenience. See whatwg/html#3656. (Note that fetch() already changed to no longer have this as a default.)

Fixing this will also require changing https://github.com/w3c/web-platform-tests/blob/master/worklets/resources/credentials-tests.js.

cc @nhiroki