Generally this is good. But I wonder, lets say you want to allow autoplay on Netflix. Do you need to enable it on all subdomains and CDNs - that could be tedious. (I don't know if Netflix has subdomains, CDN, just an example)