Remove deprecated headers

Should only be using the standard `Content-Security-Policy` header now.

Modern browsers won't even read the deprecated headers anymore.