Simplify CPS model for manifest (closes #259)

 * no longer allow the manifest to have a different policy. Depend's on owner document's CSP.