Clarify documentation for Chrome Apps CSP, link to webview, example for sandbox.

chrome/common/extensions/docs/templates/articles/app_external.html

 <h1>External Content</h1>
 
 
 <p>
 The <a href="app_architecture#security">Chrome Apps security model</a> disallows
 external content in iframes and
 the use of inline scripting and <code>eval()</code>.
 You can override these restrictions,
 but your external content must be isolated from the app.
 </p>
@@ skipping 63 matching lines @@
 <h2 id="webview">Embed external web pages</h2>
 
 <p class="note">
 <b>API Sample: </b>
 Want to play with the code? Check out the
 <a href="https://github.com/GoogleChrome/chrome-app-samples/tree/master/samples/browser">browser</a>
 sample.
 </p>
 
 <p>
-The <code>webview</code> tag allows you to embed external web content in your
+The <a href="webview_tag"><code>webview</code></a> tag allows you to embed external web content in your
 app, for example, a web page. It replaces iframes that point to remote URLs,
 which are disabled inside Chrome Apps. Unlike iframes, the
 <code>webview</code> tag runs in a separate process. This means that an exploit
 inside of it will still be isolated and won't be able to gain elevated
 privileges. Further, since its storage (cookies, etc.) is isolated from the app,
 there is no way for the web content to access any of the app's data.
 </p>
 
 <h3 id="webview_element">Add webview element</h3>
 
@@ skipping 177 matching lines @@
 so you can only whitelist all origins
 as acceptable origins ('*').
 On the receiving end,
 you generally want to check the origin;
 but since Chrome Apps content is contained,
 it isn't necessary.
 To find out more,
 see <a href="https://developer.mozilla.org/en/DOM/window.postMessage">window.postMessage</a>.
 </p>
 
-<h3 id="listen_message">Listen for message</h3>
+<h3 id="listen_message">Listen for message and reply</h3>
 
 <p>
 Here's a sample message receiver
 that gets added to your sandboxed page:
 </p>
 
 <pre data-filename="sandboxed.html">
-var messageHandler = function(e) {
-  console.log('Background script says hello.', e.data);
+var messageHandler = function(event) {
+  console.log('Background script says hello.', event.data);
+
+  // Send a reply
+  event.source.postMessage(
+      {'reply': 'Sandbox received: ' + event.data}, event.origin);
 };
 
 window.addEventListener('message', messageHandler);
 </pre>
 
+<p>
+For more details, check out the
+<a href="https://github.com/GoogleChrome/chrome-app-samples/tree/master/samples/sandbox">sandbox</a> sample.
+</p>
+
 <p class="backtotop"><a href="#top">Back to top</a></p>