Thank you! This method works even if CSP is set, since the VPN layer injects its own CSP rules into the initial GET response. From there, arbitrary scripts can

Thank you! This method works even if CSP is set, since the VPN layer injects its own CSP rules into the initial GET response. From there, arbitrary scripts can be loaded on the site.