Add X-Permitted-Cross-Domain-Policies and improve style consistency
Add Content-Security-Policy