Sandbox website tiles by default; opt into same-origin per widget

A website tile now runs in an opaque origin (allow-scripts, popups, forms).
Its new "Trusted site" setting adds allow-same-origin for sites that need
their own cookies and storage, and a trusted tile pointing at the origin the
app runs on (its own, or the hub's) shows a notice instead of the frame.

docs/interface/dashboards.md

@@ -37,6 +37,7 @@ and dragging is off. Picking a widget and editing its settings still works.
 | **Media** | `image`, `audio`, `video` | a camera frame, a clip; see *Media tiles* below |
 | **Player** | `record` | what a streamer is playing, with its transport; see *Player tiles* below |
 | **Clock** | — | the time, in a size a wall can read |
+| **Website** | — | another site's page in the tile; see *Website tiles* below |
 
 Every widget carries a **title**, and **Show title** decides whether the panel
 draws it. Turned off, the tile is just the reading, which is what a row of
@@ -145,6 +146,21 @@ The position counts forward in the browser between readings, so the bar moves
 at one second while the device is polled at whatever rate suits it. Every
 reading that arrives is taken as the truth and the count restarts from it.
 
+## Website tiles
+
+A website tile frames whatever page its **Address** points at: a weather map, a
+camera's own web interface, a timetable. A site that refuses to be framed shows
+its own refusal in the tile.
+
+The page runs sandboxed. By default it gets an origin of its own that matches
+no site, so it can run scripts but has no cookies or storage, and many
+interactive pages will not load like that. **Trusted site** lets it keep its
+real origin, with its cookies and storage, which is what visiting the site
+would give it. Turn it on only for a site you trust. A trusted tile pointing at
+this app's own address, or the hub's when the app is reached through one, shows
+a notice instead: on that origin the page could reach into the app and read
+your session.
+
 ## Dashboard settings
 
 Most of what a dashboard carries is a widget: a tile bound to a message. A