loosen CSP when lowering label; todo: keep origin document csp when set from header
allow unsafe inline