Add a MAY statement for fullscreen.
Specify the behaviour for iframes.
Merge pull request #7 from mounirlamouri/gh-pages

Security model: add sandboxing behaviour and mention fullscreen as MAY