Don't have WebGL being click-to-play on the standard security level
There is no reason to treat WebGL differently than any other active content like video/audio on the standard security level, especially as we are claiming that we have all web features enabled on that level.