Replicate Content-Security-Policy into remote frame proxies.

content/browser/frame_host/navigator_impl.cc

Index: content/browser/frame_host/navigator_impl.cc
diff --git a/content/browser/frame_host/navigator_impl.cc b/content/browser/frame_host/navigator_impl.cc
index 6fcdb074b4a0f6badd1ea04256214a7e2223480d..407dbb8c0191af9b6364c32066082f65beb6d13e 100644
--- a/content/browser/frame_host/navigator_impl.cc
+++ b/content/browser/frame_host/navigator_impl.cc
@@ -512,6 +512,11 @@ void NavigatorImpl::DidNavigate(
   render_frame_host->frame_tree_node()->SetCurrentOrigin(
       params.origin, params.has_potentially_trustworthy_unique_origin);
 
+  // Navigating to a new location means a new, fresh set of http headers and/or
+  // <meta> elements - we need to reset CSP policy to an empty set.
+  if (!is_navigation_within_page)
+    render_frame_host->frame_tree_node()->ResetContentSecurityPolicy();
+
   render_frame_host->frame_tree_node()->SetEnforceStrictMixedContentChecking(
       params.should_enforce_strict_mixed_content_checking);