Nail down URL globbing

[slightlyoff]

The plan in discussion is to lift matching from CSP: http://w3c.github.io/webappsec/specs/content-security-policy/csp-specification.dev.html#matching

However, this isn't a complete match as we only allow same-origin URLs as scopes and our path matching needs to determine a "longest prefix" match in some way.

[slightlyoff]

We've got a discussion for longest-prefix match in the explainer, but leaving this open until it's in the spec proper.

One (perhaps) sticky point: many servers have the behavior of treating "/app" and "/app/" the same. It's common enough that we might choose to add something like it for patterns like "/app/*".

Thoughts?

[slightlyoff]

Per today's f2f discussion, this is your app's responsibility. Closing and marking todoc.