Added unprefixed Content-Security-Policy

During our security review at Mozilla, we were asked to also include the unprefixed 'Content-Security-Policy' as an additional header.