*Require a strict Content Security Policy of "default-src 'self'"
*Not a common application type; reserved only for critical applications
*No same-origin restrictions for app content; same origin still enforced for non-app content.
==Installation Experience==