CSP 1.1: Remove normative bookmarklet reference.

This closes the action which Cox requested in the 2014-02-26 call[1].

[1]: http://www.w3.org/2014/02/26-webappsec-minutes.html#action01
CSP 1.1: Add non-normative language for extensions.

After discussion outside the WG, on the list[1] and on the
2014-02-16 call[2], the WG decided to revisit the change in
[3]. The language in this patch seems like a compromise that
everyone can accept.

[1]: http://lists.w3.org/Archives/Public/public-webappsec/2014Feb/0098.html
[2]: http://www.w3.org/2014/02/26-webappsec-minutes.html
[3]: https://github.com/w3c/webappsec/commit/cbfaa8edfadebf21a9c7428242c12e45934d8c55