Any origin served with CSP sandbox (without allow-same-origin) will have opaque origin. But until that response header comes back, browser would not know its origin.

We should probably treat CSP sandboxed page as cross-origin even though the tuple of scheme, host, and port would match. But is it same-site or cross-site?