fight XSS, implement CSP