My company would use the current version of the Content-Security-Policy header.
- CSRF Token support
- the login.html template
- Maybe other source code files
Is it possible to add the header only for none CP requests?