CSP: "local schemes" should inherit policy when embedded.

third_party/WebKit/Source/core/loader/DocumentLoader.cpp

Index: third_party/WebKit/Source/core/loader/DocumentLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/DocumentLoader.cpp b/third_party/WebKit/Source/core/loader/DocumentLoader.cpp
index 90c4187918135b4ca10e9970d0cc91b43fe0756c..8a8a81f1abaf1d1b390dde0351d85c75a01e45a0 100644
--- a/third_party/WebKit/Source/core/loader/DocumentLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/DocumentLoader.cpp
@@ -397,6 +397,7 @@ void DocumentLoader::cancelLoadAfterXFrameOptionsOrCSPDenied(
   // TODO(mkwst):  Remove this once XFO moves to the browser.
   // https://crbug.com/555418.
   clearMainResourceHandle();
+  m_contentSecurityPolicy.clear();
   KURL blockedURL = SecurityOrigin::urlWithUniqueSecurityOrigin();
   m_originalRequest.setURL(blockedURL);
   m_request.setURL(blockedURL);