yeah, using a static nonce is not something I would encourage :) in fact, I should rip out https://github.com/twitter/secureheaders/blob/master/lib/secure_headers/headers/content_security_policy.rb#L216 too