add initial version of Content Security Policy responder