You can also use JS to inject a CSP and it will enforce the strict most policy.