Maybe we can do the same here, declare the CSP in the manifest and use the same policy for web request ? What do you think ?