re-add prefixed CSP headers, as webkit browsers still need them