The introduction contains the following:

"Content Security Policy (CSP) is not intended as a first line of defense against content injection vulnerabilities."

For those readers not familiar with the details of secure programming, it would be useful to add a Note referring to some work(s) that address the "first line[s] of defense".