relax content security policy
amd is meaningless
fix permission