https://wicg.github.io/web-transport/#protocol-security says: “All transports must allow the server to filter connections based on the origin of the resource originating the transport session.” but...