• Cross-origin web workers are not natively supported yet, and workaround requires fetching JS as text and creating worker via blob URL.
• Can't send credentials (experiments cookie) with XHR due to CORS. Specifically, if sending credentials then cache's Access-Control-Allow-Origin is value must not be wildcard (*).

Some options:

• Figure out the current RTV and fetch that instead.
• Ask caches to respond to ww.js fetches with response headers Access-Control-Allow-Origin: <referrer origin> and Access-Control-Allow-Credentials: true.
• Detect whether the current runtime is canary and forward that bit to the worker XHR, e.g. GET https://cdn.ampproject.org/ww.js?canary=1.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Requests_with_credentials