remove ContentSecurityPolicy