Bug 841067 - Use sandboxPrototype rather than __proto__ for marionette sandboxes. r=jgriffin

sandboxPrototype implements fancy rebinding behavior that makes things work right.
It is the "correct" mechanism to prototype a sandbox to a DOM Window.
Bug 841067 - Bind methods before injecting them in FrameWorker. r=markh

Otherwise, they won't get invoked with the proper |this|.
Bug 841067 - Fix sandbox xhr tests. r=bz
Bug 841067 - Fix up CertUtils. r=bz

This is yet another piece of broken code that relies on the "find the |this|
object" behavior that we're removing. Moreover, it's not caught by our compat
hack, because Components.utils is a bizarre object that implements
nsIXPCScriptable (giving it a custom JSClass->name that's not XPCWN_NoHelper)
while not implementing nsIClassInfo (which would have put the method on the
prototype and made this never work in the first place). We _could_ add special
support for the Cu JSClass name in our compat hack, but I think we should just
fix it here and assume this pattern is not particularly common in external
consumers.