try to parse manifests, discover that CSP doesn't apply to packaged app manifests, file bug