We are actually using option 2 at the moment, the only downside is that is still requires pushing code, we were hoping that we could find a solution where we can edit the styles right there on the page. I don't think overlaying the xss protection is a good idea as you mentioned, so I will discuss th...