Comment by dylz

You can't be assured that they will send that CSP header or meta tag with every request, either. If your threat model includes this, might as well save the page locally.