XSLT should not run with policy "script-src http://www2.w3c-test.org".