[subsumption_algorithm-self.html]
  [Returned CSP must not allow 'self' if required CSP does not.]
    expected: FAIL

  [Returned 'self' should not be subsumed by a more secure version of origin's url.]
    expected: FAIL