As far as I can tell, setting `document.documentElement.innerHTML` does not trigger loading a CSP policy. I tested this by activating PR logging for CSP and trying to set the attribute in the developer console. If you think about it, it makes sense - where would the policy come from? You need to make this document element an app somehow. The easiest thing to do is probably to use an iframe instead, and set the `mozapp` attribute (although I'm not an expert on this, and might be missing some details).