Bug 754915: auto-disable profile loaded add-ons, and disable web-triggered XPI installation, r=myk, f=Unfocused

--HG--
extra : transplant_source : j%7C%3A%EB%5C%C9%9C%93%15%AD%ED%82%7B%29p%8D%8B%40%1A%C2

webapprt/prefs.js

@@ -5,5 +5,9 @@
 pref("browser.chromeURL", "chrome://webapprt/content/webapp.xul");
 pref("browser.download.folderList", 1);
 
-// Disable all add-on locations other than the profile
+// Disable all add-on locations other than the profile (which can't be disabled this way)
 pref("extensions.enabledScopes", 1);
+// Auto-disable any add-ons that are "dropped in" to the profile
+pref("extensions.autoDisableScopes", 1);
+// Disable add-on installation via the web-exposed APIs
+pref("xpinstall.enabled", false);