it sucks because CSP wants these as settings which should be before urls get parsed... yeah