meta restrictions (ACTION 109)

Here are some proposed restrictions on directives in a policy specified
in a <meta> tag.  The spec already restricts the report-uri directive.
Although it would be foolish to use policy-uri in a meta header I don't
think we need to explicitly restrict it.

-Dan Veditz