Content Security Policies: Let's Break Stuff