modify CSP header to allow script injection from harvestapp.com