Simplify CPS model for manifest (closes #259)

 * no longer allow the manifest to have a different policy. Depend's on owner document's CSP.
 * SVG figure reflects the change above. 

@kenchris, this is for you.