Browser-Enforced Embedded Policies