s/active network attacker/attacker/
Note that MIME type attacks are dangerous.
Caching recommendations: MUST NOT rather than SHOULD ONLY.
Clarify that the `error` event in question is on an element.
Marking JS stuff as TODO.
Strawman: `require-for-all` value for the CSP directive.
Regenerate.