mozilla/browserid — pull request #3988 by mattbasta (2013-10-17 18:11:04+00:00)
Title: Allow scripts in inline ToS/PP pages (issue #3987)

This allows scripts to run in inlined ToS/PP pages, but not to access local assets. Even if an attacker specified a page on the persona origin, it would run in a unique origin that would not have access to the local storage.