While Safari supports the policy, it does not (currently, as of 9.x)
recognize `origin-when-cross-origin` as a valid value, so we omit the
policy entirely under Safari.

Closes #5609