enable CSP header on static resources