fixed customevent support for safari
removed CSP directives for now