User Agent may want to restrict cross-origin transferSize/encodedBodySize/decodedBodySize visibility even with TAO

[achristensen07]

Doing so would prevent a side-channel to gather data even from origins that send TAO headers. Similar to w3c/server-timing#89 which proposes a similar restriction for Server Timing.

[yoavweiss]

This was discussed at TPAC, and there was agreement we can allow such UA liberties in the spec.

@achristensen07 - Are you interested in submitting a PR to that effect?

[achristensen07]

I can make a PR