Updated to PDF.js 1.0.907
Enhanded recommended CSP to include support for pdf web worker which loads stuff from blob: urls.