xhr-src replaced by connect-src