Allowed www.google-analytics.com in CSP header