title: Firefox Add-on SDK extension with Websocket doesn't work for Facebook/Twitter
body: <p>I'm developing a Firefox extension based on Addon SDK.
  Inside my content script, I need to create WebSocket connection to my localhost server using wss. 
  In my addon script (index.js), I use "sdk/tabs" to inject content script.</p>
  
  <pre><code>var tabs = require("sdk/tabs");
  tabs.on("ready", function(tab){
       var worker = tab.attach({
           contentScriptFile: ["./websocket.js"]
       });
  });
  </code></pre>
  
  <p>data/websocket.js looks like:</p>
  
  <pre><code>websocket = new WebSocket("wss://localhost:8443/WebsocketServer/");
  websocket.onopen = function(evt){
                         console.log("connection open");
                         websocket.send("connection established!");
                     };
  websocket.onmessage = function(evt){
                            console.log("message received: "+evt.data);
                     };
  </code></pre>
  
  <p>I open firefox and open a page with <code>https://localhost:8443/</code> and accept the certificate. So the certificate won't be a problem here.</p>
  
  <p>I can open a normal http page and this addon works perfectly, talks to my websocket server. Also I can make it work if I open <code>https://google.com</code>.
  But when I open <code>https://www.facebook.com</code> or <code>https://www.twitter.com</code>, the websocket connection cannot be established.</p>
  
  <p>When I turn on developer console, i can see error message: </p>
  
  <pre><code>Content Security Policy: The page's settings blocked the loading of a 
  resource at wss://localhost:8443/WebsocketServer/ ("connect-src 
  https://graph.facebook.com https://*.giphy.com https://pay.twitter.com 
  https://analytics.twitter.com https://media.riffsy.com 
  https://upload.twitter.com https://api.mapbox.com https://twitter.com").
  
  
  Content Security Policy: The page's settings blocked the loading of a   
  resource at wss://localhost:8443/WebsocketServer/ ("connect-src    
  https://*.facebook.com https://*.fbcdn.net https://*.facebook.net 
  https://*.spotilocal.com:* https://*.akamaihd.net wss://*.facebook.com:* 
  https://fb.scanandcleanlocal.com:* https://*.atlassolutions.com 
  https://attachment.fbsbx.com ws://localhost:* blob:").
  </code></pre>
  
  <p>After I check, find facebook and twitter both implement the content script policy in their http header: 
  <a href="https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy" rel="nofollow">https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy</a></p>
  
  <p>But I think this policy should be exempted for addon. How could I bypass this check and make my websocket connection also work on facebook and twitter also?</p>
  
  <p>I found there is one link that uses XPCOMM to hyjack http header and bypass the CSP check, but this is not I'm looking for, as XPCOMM will be deprecated by firefox. Is there a more proper way of doing this?</p>
  
  <p>Thanks a lot!</p>