CSP: message-src and message-sink

This pull-request is not meant to be integrated directly (at the moment), but rather as a point of discussion. It's unfortunate that Github issues doesn't have way to attach patches.