--- a/browser/modules/Feeds.jsm
+++ b/browser/modules/Feeds.jsm
@@ -78,19 +78,21 @@ this.Feeds = {
     var type = aLink.type.toLowerCase().replace(/^\s+|\s*(?:;.*)?$/g, "");
     if (!aIsFeed) {
       aIsFeed = (type == "application/rss+xml" ||
                  type == "application/atom+xml");
     }
 
     if (aIsFeed) {
       // re-create the principal as it may be a CPOW.
+      // once this can't be a CPOW anymore, we should just use aPrincipal instead
+      // of creating a new one.
       let principalURI = BrowserUtils.makeURIFromCPOW(aPrincipal.URI);
       let principalToCheck =
-        Services.scriptSecurityManager.createCodebasePrincipal(principalURI, {});
+        Services.scriptSecurityManager.createCodebasePrincipal(principalURI, aPrincipal.originAttributes);
       try {
         BrowserUtils.urlSecurityCheck(aLink.href, principalToCheck,
                                       Ci.nsIScriptSecurityManager.DISALLOW_INHERIT_PRINCIPAL);
         return type || "application/rss+xml";
       }
       catch(ex) {
       }
     }