Actually the spec says that this is the correct way of doing it: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html

However, Chrome and others don't seem to support this yet. I like the change of @IgorMinar as it allows to manually override the autodetection and it is quite simple.