content security policy

thanks to @devAlien