diff --git a/dev/demo/plugin-client.html b/dev/demo/plugin-client.html
index 52f35de..f426d8f 100644
--- a/dev/demo/plugin-client.html
+++ b/dev/demo/plugin-client.html
@@ -17,9 +17,20 @@
   </head>
   <body style="background-color: yellow">
     <h2>Example Widget!</h2>
+    <script>
+      function flood () {
+        var i = 0;
+        for (; i < 90; i++) {
+          KorAPlugin._sendMsg({
+            'action' : '-'
+          });
+        };
+      };
+    </script>
     <ul>
       <li><a onclick="KorAPlugin.log(333, 'Huhu!')">Send log!</a></li>
       <li><a onclick="KorAPlugin.resize()">Resize</a></li>
+      <li><a onclick="flood()">Flood!</a></li>
     </ul>
   </body>
 </html>
diff --git a/dev/demo/plugin-server.html b/dev/demo/plugin-server.html
index f513b46..21362fd 100644
--- a/dev/demo/plugin-server.html
+++ b/dev/demo/plugin-server.html
@@ -3,6 +3,10 @@
   <head>
     <title>Plugin demo</title>
     <link type="text/css" rel="stylesheet" href="/css/kalamar.css" />
+    <!--
+        see https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src https://*; child-src 'none';">
+-->
     <script data-main="/demo/plugin-serverdemo.js" src="/js/lib/require.js" async="async"></script>
   </head>
   <body>