make csp compliant version avoid xhr'ing for documents