adding content security policy and host permissions