Currently nostate prefetch will cancel prefetch if it encounters a meta CSP tag, but will go through with prefetch normally if CSP is in the response header.

The reason seems to be that setting up CSP from the preload scanner (where the meta tag is seen) is complicated.