Comment 2 for bug 1260048

Note, these rules are currently in the webview policy group. If this isn't going to be fixed soon, should we at least remove 'w' access from the policy so we only have information disclosure as opposed to db poisoning?