Merge policies and set the resultant header. Now browsing with the extension can break most of the web! Yay!
Looks like we need to use X-WebKit-CSP for now. Fixing. Wow the web is busted with this right now = )