We should merge <https://src.chromium.org/viewvc/blink?view=rev&revision=183317>. Implement CSP check for manifest fetching The CSP bits include the 'manifest-src' directive, but _not_ the forthcoming "manifest that sets a CSP for its documents" feature.
<rdar://problem/24383194>
Support for the directive manifest-src was added in <https://trac.webkit.org/changeset/225564> (bug #180292).