While the exact same configuration works with VNC (so the CA is trusted and network.websocket.allowInsecureFromHTTPS is set to true), with SPICE I'm getting in the JS console:

Content Security Policy: The page's settings blocked the loading of a resource at https://sledge.kvedulv.de:5911/ ("connect-src https://sledge.kvedulv.de ws: wss:").

I think the message is not correct, as the Header looks perfectly fine:

default-src 'self'; connect-src 'self' ws: wss:; font-src 'self'; frame-src 'self'; img-src 'self' *.gravatar.com data:; media-src 'self'; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' 'self'; style-src 'unsafe-inline' 'self';

This is with Iceweasel (Debian's Firefox) 44.0.2.