CSP: Document proposed solution to redirect-target path leakage.

In a nutshell, this proposal patches the matching algorithm to ignore
the path component in source expressions if the URL being matched is the
result of an HTTP redirect. Since these requests will now be host/scheme
based, we still get reasonable protection by limiting resources to
allowed origins after a redirect, while not allowing malicious parties
to brute-force paths through cleverness.
Assorted typo fixes
Three typo fixes
Changing "disactivate" to "deactivate"
Merge pull request #20 from terriko/master

A few typographical fixes for CSP 1.0 and 1.1 and also SRI
Merge pull request #18 from w3c/paths-and-redirects

CSP: Document proposed solution to redirect-target path leakage.
CSP: Cleanup. No normative changes.