--- a/browser/base/content/test/general/browser_bug413915.js
+++ b/browser/base/content/test/general/browser_bug413915.js
@@ -2,17 +2,24 @@ XPCOMUtils.defineLazyModuleGetter(this, 
   "resource:///modules/Feeds.jsm");
 
 function test() {
   var exampleUri = makeURI("http://example.com/");
   var secman = Cc["@mozilla.org/scriptsecuritymanager;1"].getService(Ci.nsIScriptSecurityManager);
   var principal = secman.createCodebasePrincipal(exampleUri, {});
 
   function testIsFeed(aTitle, aHref, aType, aKnown) {
-    var link = { title: aTitle, href: aHref, type: aType };
+    var link = {
+      title: aTitle,
+      href: aHref,
+      type: aType,
+      ownerDocument: {
+        characterSet: "UTF-8"
+      }
+    };
     return Feeds.isValidFeed(link, principal, aKnown);
   }
 
   var href = "http://example.com/feed/";
   var atomType = "application/atom+xml";
   var funkyAtomType = " aPPLICAtion/Atom+XML ";
   var rssType = "application/rss+xml";
   var funkyRssType = " Application/RSS+XML  ";

--- a/browser/modules/Feeds.jsm
+++ b/browser/modules/Feeds.jsm
@@ -70,24 +70,19 @@ this.Feeds = {
 
     var type = aLink.type.toLowerCase().replace(/^\s+|\s*(?:;.*)?$/g, "");
     if (!aIsFeed) {
       aIsFeed = (type == "application/rss+xml" ||
                  type == "application/atom+xml");
     }
 
     if (aIsFeed) {
-      // re-create the principal as it may be a CPOW.
-      // once this can't be a CPOW anymore, we should just use aPrincipal instead
-      // of creating a new one.
-      let principalURI = BrowserUtils.makeURIFromCPOW(aPrincipal.URI);
-      let principalToCheck =
-        Services.scriptSecurityManager.createCodebasePrincipal(principalURI, aPrincipal.originAttributes);
       try {
-        BrowserUtils.urlSecurityCheck(aLink.href, principalToCheck,
+        let href = BrowserUtils.makeURI(aLink.href, aLink.ownerDocument.characterSet);
+        BrowserUtils.urlSecurityCheck(href, aPrincipal,
                                       Ci.nsIScriptSecurityManager.DISALLOW_INHERIT_PRINCIPAL);
         return type || "application/rss+xml";
       } catch (ex) {
       }
     }
 
     return null;
   },