added the feature of further limiting behaviors --- nodes have 'owner' attribute, which is set to whoever created it, by either calling document.createElement or document.write, setInnerHTML, etc.  Policy can include [o] at the start of an entry to specify the node must be owned by the domain