added content security policy