Sorry, I know I'm drifting massively off topic now, but why on earth would any company adopt such a policy? It's not even as if CSS files can carry executable code (sure, they can reference such content, but then block that stuff instead of the style sheets themselves).