Our current code only calls [AVCaptureDevice ensureServerConnection] the first time we extend the sandbox. This can lead to problems if the user visits a site that only needs Microphone access (for example), and then visits a site that needs Camera access. Because the camera-related extensions are only recognized by the video capture system when [AVCaptureDevice ensureServiceConnection] is called, the fact that we called it before the new sandbox extensions were in place mean we never activate the relevant features.

To fix this, we should simply call [AVCaptureDevice ensureServerConnection] any time we extend the sandbox. I have confirmed with the relevant teams that this call is low-cost (performance wise), and is not harmful to call repeatedly for things that have already been activated.