Add CSP fallback to sandbox.html for non-chrome app runtimes