Very often when we call canDisplay, we call contentSecurityPolicy. We should unify the two somehow.
This statement doesn't seem to be true. There are plenty of instances of one without the other.