title: Chrome 63 seems to ignore or break on worker-src CSP headers
body: <h3>The Error</h3>
  
  <p>I'm developing several apps that use web workers and all of them are kind of broken using the latest <code>Chrome V63.0.3230.132</code>.</p>
  
  <p>This is the error message I see on the console:</p>
  
  <blockquote>
    <p>[Report Only] Refused to create a worker from '<a href="http://localhost:8080/d04af186322390d53036.worker.js" rel="noreferrer">http://localhost:8080/d04af186322390d53036.worker.js</a>' because it violates the following Content Security Policy directive: "worker-src 'none'".</p>
  </blockquote>
  
  <p>I've also noticed <a href="https://web-perf.github.io/react-worker-dom/test/dbmonster/index.html#count=1&amp;timeout=0&amp;worker=true&amp;rows=50" rel="noreferrer">some other sites</a> behaving the same way.</p>
  
  <p>Apparently, it doesn't matter how one creates that worker.
  I tried it in a react app using <a href="https://github.com/webpack-contrib/worker-loader" rel="noreferrer">worker-loader</a>, but also in a plain JS demo where I created it manually. The error remains the same.</p>
  
  <h3>What I tried</h3>
  
  <p>I've got all the CSP headers in place, and also updated my <code>manifest.json</code> files with <a href="https://developer.chrome.com/extensions/contentSecurityPolicy" rel="noreferrer">the correct CSP entry</a> to no avail.</p>
  
  <p>All other browsers are working fine.</p>
  
  <p>Can someone confirm or explain this behavior?</p>