CSP: frame-src 'none'

Normal filter: ||echo.websocket.org

CSP filter: *$websocket,domain=kzar.co.uk

WebRTC blocking without unsafe-eval (#5953) test page