A blob fetched from somebody else's server keeps the locked-down policy its own handler states, rather than leaving with the one every page gets. Both were well-formed headers, so nothing failed and nothing logged.