Content Security Policy middleware