change CSP to load https youtube frames