XHR export always; grant; import (wip)

Assuming bug 886164, XHR is always exported in sandbox. Using CSP to
restrict communication. Public label allowed to perform arbitrary
requests using null origin.

TODO:
 - XHR export: public label use origin of the page
 - import needs to actually evaluate imported string. seems like there
   is a new EvaluateString function in head so rebasing