Restore confirm API so that script origin can check for only its own stored exceptions

[royfielding]

Part of my changes to the API made it easier for a script to check for an exception that applies from the current top-level site to a given target, but that contradicta an earlier consensus that a script origin could only confirm the exceptions that it had stored itself.