Fix #2167: require works in wrong path in new-instance window

the url we get from DOM is 'about:blank' in DidCreateScriptContext.
check this later in willSetSecurityToken again and set it