Bug 1031372 - CSP parser should accept 127.0.0.1:* (r=sstamm)
Bug 1031259 - CSP: Should allow external loads if no matching directive and no default-src is defined (r=sstamm)