Add Content-Security-Policy headers.