[strictnein]

Yep, was going to say exactly this.

All the SRI, CSP, etc is great, but if you can't control your own site you're screwed regardless.