If we load a manifest that is not a resource uri, ensure that the urls are same-origin.
Would another option be that we don't support absolute URLs in the manifest, apart from, say, URLPrefix?
For the manifest urls, we are absolutely talking same-origin, protocol+host+port. URLPrefix should only be used in the case we are loading from a resource URI, otherwise it should be ignored.
pushed a validation/cleansing function in change https://github.com/mozilla/socialapi-dev/commit/3a731bfad4e4a861b17be5e3e0048f6e480dc143
pushed tests on this today https://github.com/mozilla/socialapi-dev/commit/f9d2f6388b219df49e9809fb3a85b3d9e8f0e3a0