Restrict security origin inheritance to empty, about:blank, and about:srcdoc URLs