I don't currently see how the average user would be able to handle that.
The CSP header can be limitless complex. See http://cspisawesome.com/ for a try at a wizard.

I don't see an easy way to implement that right now. So what do you suggest?

It is indeed a good practice to return a Content-Security-Policy header as it prevents different types of XSS attacks.

IMHO you have two way of implementing this:

• Add a setting page allowing the user to tweak the policy.
• Use a very generic policy that could work almost everywhere.

Here is what we use on our server:
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none'; style-src 'self' 'unsafe-inline'; frame-ancestors http:; img-src 'self'

Here is what it means:

• By default only allow resources from the same domain.
• Allow scripts from the same domain, from inline scripts or from eval().
• Don't allow objects and embeds.
• Only allow styles from the same domain or from inline styles.
• Allow forms to be included in iframes from any domain over HTTP(S).
• Only allow images from the same domain.

(The last one could be made less strict if people need to include images from other domains.)

Allowing inline scripts and eval is not very secure but disallowing them breaks some parts of LimeSurvey :/

It's also a good idea to define the following headers:
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

This won't be implemented as we consider this to be a server-side setting.