CSP Level 2 last call comment

One final last call comment if it's not too late...

The directive-value ABNF for frame-ancestors is just listed as "source-list".

The previous ABNF when it was in the UISecurity spec, and previous X-Frame-Options behavior, should only accept a list of host-sources, or should discard any extra path information and use only the Origin.  This is not reflected in current spec text.

-Brad