more on csp descript & tweaking why csp is not good enough for password checker
add commit messages