Update 'Content-Security-Policy' header (drop 'X-' prefix)