ability to block active content: javascript, XHR/websockets, webfonts, audio/video, plugin objects.

See http://www.html5rocks.com/en/tutorials/security/content-security-policy/#policy-applies-to-a-wide-variety-of-resources for capabilities

Warnings are displayed for iOS 5.1 users. (5.1 is earliest version we support.) Per http://caniuse.com/contentsecuritypolicy , iOS Safari 5.X only contains partial support. Per http://stackoverflow.com/questions/13663302/why-does-my-content-security-policy-work-everywhere-but-safari , this support is buggy at best.