added rudimentary csp (mostly broken still)