Bug 886164 - Enforce CSP in sandboxed iframe, r=grobinson