We shouldn't use "omit" as a default. We should use "same-origin" for web developer convenience. See whatwg/html#3656. (Note that fetch() already changed to no longer have this as a default.)
Fixing this will also require changing https://github.com/w3c/web-platform-tests/blob/master/worklets/resources/credentials-tests.js.
cc @nhiroki