Not sure if this is considered bad practice, but I have uMatrix installed with noscript. I use uMatrix for script blocking and have noscript set to globally allow scripts, with ABE, XSS, clickjacking, etc protection enabled to cover the weak points of uMatrix.