It works on Chrome too, but so far (Version 26.0.1410.64 m) only with the temporary
X-Content-Security-Policy instead of
Content-Security-Policy header, as defined in the already updated code samples. W3C Web Application Security working group just moved the Content Security Policy 1.1 from previous working group draft to a W3C Editor's Draft status today, on 28th of April 2013. What are the chances of that, huh?
I guess Google Code jumped the gun with already updated code samples a few days too soon, and I expect the next Chrome update to change this accordingly.
Anyway, the solution was hiding in the fineprint of the Google's cached copy of previous draft version of CSP 1.1:
This document describes a proposal that has been discussed by the
broader community for about two years. There are experimental
implementations in Firefox and Chrome, using the header names
X-WebKit-CSP respectively. Internet
Explorer 10 Platform Preview also contains a partial implementation,
using the header name
If we check Google Code samples again, the difference in these header values becomes glaringly obvious:
<meta http-equiv="Content-Security-Policy" content="script-nonce noncynonce;">
So it looks that all you have to do (for the time being, until Chrome updates to reflect the status change of the CSP 1.1 proposal) is, to change the header name back to
I've also tested these samples on latest Firefox and Opera browsers, and they already accepted
Content-Security-Policy and didn't complain with console errors.