add CSP for packaged app