HTTP Security headers you should be using
Can you specify domain wildcards in Content-Security-Policy script-src? For example:    Content-Security-Policy: script-src 'self' *.somedomain.com

Also, while it looks great, usually its very difficult to integrate this header, without breaking existing JS functionality. For example, if you set this header, inline JavaScript will not be executed, this includes added event methods directly on DOM elements. Also eval() and writing setTimeout() and setInterval() like:    window.setInterval("alert('hi')", 10);

Are forbidden from executing as well. Finally, using 3rd party libraries (Mixpanel, Google hosted libraries, Intercom.io) becomes nearly impossible without explicitly whitelisting domains in the header (a huge hassle to maintain).