Extra security headers without a home

given the nature of this header - it's probably better to document, or provide a bare-minimum example - rather than provide a long list of domains. Your opinion?