Bug 1021972 - csp attribute in manifest doesnt actually apply a CSP r=ochameau