added a content security policy to stop people from loading images and scripts from other servers