CSP 1.1: Clarify 'sandbox' behavior in a report-only policy.