add reportOnly param to csp

fixes #4