Good questions! Here are the points I found:

- Regarding fonts: we are loading currently fonts from a netdna cdn, I want to remove this already in https://issues.apache.org/jira/browse/COUCHDB-2238

- `unsafe-eval`: our dependency lodash needs it for the templating if I remember right

- img-src will have a look again and change it, if everything works

- style-src: we are having a lot of inline styles where we depend on, sometimes it is not that easy to remove them