Correctly parse manifest URLs and reject invalid ones

The Web App Manifest spec requires invalid URLs to be discarded and some default used instead, e.g. in the parsing of start_url. Node’s url.resolve is very lenient with what it accepts, and what throws as an error when passed to new URL(...) in the browser is accepted happily in node.

One option is using whatwg-url for URL parsing

In general, using it would be an improvement in predictability, since we would be parsing URLs in node the same as they would be in the browser.

Downside: three new dependencies, as whatwg-url depends on webidl-conversions and tr46

[paulirish]

I’m a big fan of moving to whatwg url parser. It’s more stable, has support for .origin. It’s really just a polyfill until node lands the parser in nodejs core: https://github.com/nodejs/node-eps/blob/master/003-url.md & https://github.com/nodejs/node/pull/7448

We can exclude it from the bundle for clientside builds, and we’ll be able to get rid of the url.js module from the browserify builds as well.

[brendankenny]

fixed in #997!