mozilla/goggles.webmaker.org — pull request #115 by admix (2014-03-14 14:13:25+00:00)
Title: Added CSP in Report-Only mode into goggles.webmaker.org

Added CSP to goggles.webmaker.org. The only one thing is that - when you click on "Active X-Ray Goggles" CSP catches inline script somewhere, I am not quite sure where. I would really appreciate to get help finding it.
I have a suggestion: There is a div:

{{ gettext("Activate X-Ray Goggles") }}

It has 'id="bookmarklet-link"' , I guess that it could be a cause for that.