Restrict app sandbox's CSP to disallow loading web content in them.

chrome/test/data/extensions/api_test/sandboxed_pages_csp/remote_frame.js

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+window.onload = function() {
+  window.parent.postMessage(JSON.stringify(['loaded', 'remote_frame.html']),

[Devlin, 2016/12/22 17:04:32]

nit: indentation
window.parent.postMessage(
    JSON.stringify(...), '*')

[lazyboy, 2016/12/22 22:57:06]

Done.

+      '*');
+};
+