The empty URL is used both for representing a missing origin (browser-initiated navigation request) and a unique/opaque origin. This is problematic since the security implications are very different in these two cases: browser-initiated requests usually should have high security clearance, while requests from unique origins should be restricted.