The idea here is that the "browser's address bar origin" is an additional key for its HTTP cache, to prevent certain classes of attacks. Safari ships a variant of this (uses registrable domain, not...