Great job. Though I am still waiting for official CSP support, it seems like it should already be there. Unfortunately the legacy angular code prevents us from applying any real policy.