ready for cross-origin tests. CSP part not working properly