Instruct Twitter to stop injecting inline JavaScript.

Would allow turning sandboxing on.
Drop Vimeo support.

It causes errors. It sends wrong content types. As we
have no-sniff on to prevent exploitations, it then
results in additional security restriction errors.

Vimeo also does tracking, and sets cookies.