Has anyone demonstrated XSS attacks that work even when CSP is properly configured?  Seems like all discussion of XSS now-a-days should be preceded with a note that you should go turn on CSP before worrying about any other form of prevention.