[cssom] Add some cross-origin security considerations. https://www.w3.org/Bugs/Public/show_bug.cgi?id=22453