You'll need to add CSP to more than just the index page, there's a bunch that need CSP. If you wanted to reeeally cover everything, you could add it inside an `app.use()` block further up in the file.