Document sandboxed with Content-Security-Policy HTTP header