Last Call: Content Security Policy 1.0
w3.org