Add report-only CSP header