title: Can you disable a web document's Content Security Policy? (connect-src)
body: <p>I have a browser bookmarklet that invokes an HTTP request using javascript. It works for every single website I've tried it on except Facebook. Facebook has some kind of content security policy that only allows the window to get resources from its own domain. The error in Chrome's inspector says:</p>
  
  <pre><code>Refused to connect to 'http://my.website.com:4447/yurl/stash?rootId=45&amp;param1=http%3A%2F%2Fwww.facebook.com%2Fhemal.narayan' because it violates the following Content Security Policy directive: "connect-src https://*.facebook.com http://*.facebook.com https://*.fbcdn.net http://*.fbcdn.net *.facebook.net *.spotilocal.com:* https://*.akamaihd.net ws://*.facebook.com:* http://*.akamaihd.net https://fb.scanandcleanlocal.com:* *.atlassolutions.com http://attachment.fbsbx.com https://attachment.fbsbx.com".
  </code></pre>
  
  <p>Since I can't do anything malicious to the remote website, I am hoping there's a way to disable this at the client's discretion, like with CORS.</p>
  
  <p>Is there a way to disable this policy?</p>