Today I learned that the "report-uri" directive in Content Security Policy 3 has been deprecated in favour of a "report-to" directive. It's probably not worth transitioning all my webservers yet, though.