So https and content security policy should be enough to mitigate this kind of stuff or am I wrong?<p>If they would amend csp headers and inject stuff I would be worried but still there would be https for the rescue.