Facebook using Content Security Policy headers for Webkit.

It looks like Facebook is using the experimental CSP headers today. I am kinda amused by some of the whitelisted domains and apps.

I have provided here for your amusement.

    x-webkit-csp:default-src *;
     script-src https://*.facebook.com 
                http://*.facebook.com 
                https://*.fbcdn.net 
                http://*.fbcdn.net 
                *.facebook.net 
                *.google-analytics.com 
                *.virtualearth.net 
                *.google.com 
                127.0.0.1:* 
                *.spotilocal.com:* 
                chrome-extension://lifbcibllhkdhoafpjfnlhfpfgnpldfl 
                'unsafe-inline' 
                'unsafe-eval' 
                https://*.akamaihd.net 
                http://*.akamaihd.net;
      style-src * 'unsafe-inline';
      connect-src https://*.facebook.com 
                http://*.facebook.com 
                https://*.fbcdn.net 
                http://*.fbcdn.net 
                *.facebook.net 
                *.spotilocal.com:* 
                https://*.akamaihd.net 
                ws://*.facebook.com:* 
                http://*.akamaihd.net;