Re: CSP: Embedded Enforcement

If I'm reading the spec correctly (§3.3) this does not recurse into nested
iframes. I haven't been able to decide whether recursing leads to terrible
things or if it's necessary to preserve protection, especially in the
same-origin case. I think recursing is arguably OK because middle frames
could have applied the same restrictions on their own and in theory know
this will be applied because of the Embedding-CSP header they got (and
agreed to by reflecting).

That does complicate the requirement that there be only one Embedding-CSP
policy, because a middle frame could apply their own csp attribute to an
embedded iframe. If both aren't passed along then we can run into potential
attacks depending on which one gets suppressed.

-Dan Veditz