CSP2: Empty sandbox directive is perfectly fine.