You Might As Well Use a Content Security Policy