this currently doesn't really work as expected, but can be used as a base
to properly implement CSP for the scripts we "know" about.