I use JS whitelisting but haven't gotten to the point of CSS off by default yet; I suppose on the majority of sites I come across, the CSS hasn't been bad enough to warrant it.