CSP 1.1: Clarify 'sandbox' behavior in a report-only policy.
SI: Downloads only protected via <a download>.

Michal Zalewski noted in [1] that we can't make meaningful promises
about integrity verification for resources interpreted as downloads
via `Content-Disposition` headers. Clever attackers have a number of
alternatives which would bypass the integrity check. He suggested
limiting the protections to `a` elements with a `download` attribute,
and further, throwing an error if `integrity` is added to any other
`a` element.

I agree.

[1]: http://lists.w3.org/Archives/Public/public-webappsec/2014Jan/0126.html
CSP 1.1: Reformulate the 'frame-ancestors' definition.

The new definition more clearly points out the algorithm necessary for
processing this header when loading a protected resource. It also
defines mitigations for potential state leakage cross-origin.