LCA: CSP for cross-site scripting protection

From my testing on Chrome v25, turning on reporting doesn't necessarily disable enforcement of CSP.

There are two possible http headers you can use (in addition to the vendor-prefixed versions): "Content-Security-Policy", and "Content-Security-Policy-Report-Only". Those are pretty self-explanatory. However there is also a "report-uri" Content-Security-Policy directive, which notifies the administrator of errors while still enforcing the CSP.