- for WebKit-based browsers like Chrome, use the new CSP syntax
( see X-WebKit-CSP)
- I believe we no longer need to mention phpmyadmin.net in the allowed
  lists, due to our fetching of JSON content instead of a js