Request header's guard should be set, even if there's no init

Fixes #1074.

(This regressed in #560.)

fetch.bs

@@ -6384,6 +6384,23 @@ constructor steps are:
  <a for=Headers>header list</a> is <var>request</var>'s <a for=request>header list</a>, and
  <a for=Headers>guard</a> is "<code>request</code>".
 
+ <li>
+  <p>If <a>this</a>'s <a for=Request>request</a>'s <a for=request>mode</a> is
+  "<code>no-cors</code>", then:
+
+  <ol>
+   <li><p>If <a>this</a>'s <a for=Request>request</a>'s <a for=request>method</a> is not a
+   <a>CORS-safelisted method</a>, then <a>throw</a> a {{TypeError}}.
+   <!-- This will throw in cases where APIs have created no-cors requests with a non-safe method and
+   the developer has called new Request(fetchEvent.request) or fetch(fetchEvent.request) within a
+   service worker fetch event. This shouldn't happen, as APIs shouldn't create no-cors requests with
+   a non-safe method -->
+
+   <li><p>Set <a>this</a>'s <a for=Request>headers</a>'s <a for=Headers>guard</a> to
+   "<code>request-no-cors</code>".
+  </ol>
+ </li>
+
  <li>
   <p>If <var>init</var> <a for=map>is not empty</a>, then:
 
@@ -6400,19 +6417,6 @@ constructor steps are:
 
    <li><p>Empty <a>this</a>'s <a for=Request>headers</a>'s <a for=Headers>header list</a>.
 
-   <li>
-    <p>If <a>this</a>'s <a for=Request>request</a>'s <a for=request>mode</a> is
-    "<code>no-cors</code>", then:
-
-    <ol>
-     <li><p>If <a>this</a>'s <a for=Request>request</a>'s <a for=request>method</a> is not a
-     <a>CORS-safelisted method</a>, then <a>throw</a> a {{TypeError}}.
-
-     <li><p>Set <a>this</a>'s <a for=Request>headers</a>'s <a for=Headers>guard</a> to
-     "<code>request-no-cors</code>".
-    </ol>
-   </li>
-
    <li><p>If <var>headers</var> is a <code>Headers</code> object, then <a for=list>for each</a>
    <var>header</var> in its <a for=Headers>header list</a>, <a for=Headers>append</a>
    <var>header</var>'s <a for=header>name</a>/<var>header</var>'s <a for=header>value</a> to