fixed csp, fixed ajax request bug