content security policy headers for served documents - issue #11