Cause a Content-Security-Policy: sandbox header to unregister the Service Worker at that scriptURL.

Joshua Peek suggested that this should work
(http://lists.w3.org/Archives/Public/public-webappsec/2014Jul/0109.html)
because `sandbox` gives the resource a unique origin, which combines with
Service Workers' same-origin policy to disallow execution.

See slightlyoff/ServiceWorker#113 and slightlyoff/ServiceWorker#224.