Tested locally with a simple client and server that does CSP.

// client.go
package main

import (
	_ "syscall/js"

	"github.com/gopherjs/gopherjs/js"
)

func main() {
	js.Global.Get("document").Call("write", "Hello world!")
}

// server.go
package main

import (
	"net/http"
)

func main() {
	fs := http.FileServer(http.Dir("."))
	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Content-Security-Policy", "script-src 'self'")
		fs.ServeHTTP(w, r)
	})
	http.ListenAndServe(":8080", nil)
}

Throws an error like I expect on older versions of gopherjs.

No error with these updates.

CI tests don't test for CSP compliance (obviously 🙃), but they do run the standard syscall/js package tests, so if should inform us if anything is wrong. Overall your change is good, plus or minus the nitpick I left.

Have to log off for the evening and then I'm out of the office tomorrow, but will debug the failures Wednesday morning CDT.

Tested CSP locally again, looks good.

Thank you for your contribution!