Add policy container to request

fetch.bs

@@ -1519,6 +1519,14 @@ user-agent-defined object). Unless otherwise stated it is null.
 <a lt=fetch for=/>fetching</a>. It provides a convenient way for standards to not have to set
 <a for=/>request</a>'s <a for=request>origin</a>.
 
+<p>A <a for=/>request</a> has an associated <dfn export for=request
+id=concept-request-policy-container>policy container</dfn>, which is "<code>client</code>" or a <a
+for=/>policy container</a>. Unless stated otherwise it is "<code>client</code>".
+
+<p class="note">"<code>client</code>" is changed to a <a for=/>policy container</a> during <a
+lt=fetch for=/>fetching</a>. It provides a convenient way for standards to not have to set <a
+for=/>request</a>'s <a for=request>policy container</a>.
+
 <p>A <a for=/>request</a> has an associated
 <dfn export for=request id=concept-request-referrer>referrer</dfn>, which is
 "<code>no-referrer</code>", "<code>client</code>", or a <a for=/>URL</a>. Unless stated otherwise it
@@ -3659,6 +3667,19 @@ steps:
  <a for=request>current URL</a> is not <a lt="is local">local</a>, then set <var>response</var> to a
  <a>network error</a>.
 
+ <li>
+  <p>If <var>request</var>'s <a for=request>policy container</a> is "<code>client</code>", then:
+
+  <ol>
+   <li><p>If <var>request</var>'s <a for=request>client</a> is non-null, then set
+   <var>request</var>'s <a for=request>policy container</a> to a <a
+   lt="clone a policy container">clone</a> of <var>request</var>'s <a for=request>client</a>'s <a
+   for="environment settings object">policy container</a>. [[!HTML]]
+
+   <li><p>Otherwise, set <var>request</var>'s <a for=request>policy container</a> to a new <a
+   for=/>policy container</a>.
+  </ol>
+
  <li><p>Run <a>report Content Security Policy violations for <var>request</var></a>.
 
  <li><p><a>Upgrade <var>request</var> to a potentially trustworthy URL, if appropriate</a>.