Stop using incumbent settings object

Also adds a warning about #63.

Author: domenic

index.bs

@@ -1677,9 +1677,14 @@ Origin of Blob URLs
 Blob URLs are created using URL.{{URL/createObjectURL()}},
 and are revoked using URL.{{URL/revokeObjectURL()}}.
 The origin of a Blob URL must be the same as the [=environment settings object/origin=]
-specified by the incumbent settings object
+specified by the current settings object
 at the time the method that created it was called.
 
+WARNING: there is currently some confusion between the generic definition of the
+[=url/origin|origin of a URL=] and the specific definition of the [=origin of a Blob URL=]. This is
+tracked in issue #63 and in
+whatwg/url#127.
+
 [=CORS protocol|Cross-origin requests=] on Blob URLs must return a network error.
 
 Note: In practice this means that HTTP and HTTPS [=/origins=]
@@ -1702,7 +1707,7 @@ which is invoked by URL.{{URL/createObjectURL()}}:
   (that is, the Unicode code point sequence U+0062, U+006C, U+006F, U+0062)
   to |result|.
 1. Append the ":" (U+003A COLON) character to |result|.
-1. Let |settings| be the [=incumbent settings object=]
+1. Let |settings| be the [=current settings object=]
 1. Let |origin| be |settings|'s [=environment settings object/origin=].
 1. Let |serialized| be the ASCII serialization of |origin|.
 1. If |serialized| is "null", set it to an implementation-defined value.