Content-Security-Policy header generation