browser checks sets CSP header type