At 3. CSP Policy Delivery it says The Content-Security-Policy HTTP response header field is the preferred mechanism for delivering a policy But there are two valid mechanisms, delivery via an ...