www: set an explicit security policy for fetch documents

Not really important for MAX80, but these may be useful to have
elsewhere.

esp32/www/max80.js

@@ -1,4 +1,6 @@
 const PassiveListener = { passive: true };
+const LocalGet        = { method: 'GET', mode: 'same-origin',
+			  redirect: 'follow' };
 
 // Get an element by id or an Element object
 function getelem(id) {
@@ -22,10 +24,10 @@ function classmod(elem,tags) {
 
 // Read a key=value text file and return it as a Promise of a Map
 function fetchconfig(url) {
-    return fetch(url, {redirect: "follow"})
+    return fetch(url, LocalGet)
 	.then(res => {
 	    if (!res.ok) {
-		throw new Error("HTTP error "+response.status);
+		throw new Error('HTTP error '+response.status);
 	    } else {
 		return res.text();
 	    }
@@ -239,7 +241,7 @@ fetchconfig('/sys/lang')
 class IncHTML extends HTMLElement {
     constructor() { self = super(); }
     connectedCallback() {
-	fetch(self.getAttribute('src'))
+	fetch(self.getAttribute('src'), LocalGet)
 	    .then ((r) => r.text())
 	    .then ((text) => {
 		const p = self.parentElement;