will do the right thing. Also, change CheckLoadURI to allow null principals to load things that anyone can load (e.g. http:// URIs). Bug 337260, r=dveditz, sr=jst