Upstream doesn't disable these by default.

--- config/policy.xml.orig	2017-09-23 12:22:04 UTC
+++ config/policy.xml
@@ -64,6 +64,11 @@
   <!-- <policy domain="resource" name="map" value="4GiB"/> -->
   <!-- <policy domain="resource" name="width" value="10KP"/> -->
   <!-- <policy domain="resource" name="height" value="10KP"/> -->
+  <policy domain="coder" rights="none" pattern="EPHEMERAL" />
+  <policy domain="coder" rights="none" pattern="URL" />
+  <policy domain="coder" rights="none" pattern="HTTPS" />
+  <policy domain="coder" rights="none" pattern="MVG" />
+  <policy domain="coder" rights="none" pattern="MSL" />
   <!-- <policy domain="resource" name="list-length" value="128"/> -->
   <!-- <policy domain="resource" name="area" value="100MP"/> -->
   <!-- <policy domain="resource" name="disk" value="16EiB"/> -->
   <!-- <policy domain="resource" name="file" value="768"/> -->