always disable 'Content Security Policy' header