This is a necessary change that was done for Fluent access in bug 1573276. In almost all cases, we want to rely on the principal for making security decisions, but the principal does not store the original URI in cases where an about: page was sandboxed (it becomes a null principal URI), and thus we need to use the documentURI here. Differential Revision: https://phabricator.services.mozilla.com/D47582