@tbosch and I looked at this yesterday.  `document.securityPolicy` appears to be undefined even when the `Content-Security-Policy` header is present and csp is enabled.  This is on Chrome 29.  So not sure that this fixes it.  We couldn't find a good way to detect csp.