Implementing Drupal 8's ThemeNegotiatorInterface gives you full control of theme switching
Some pointers for honoring content security policies