Update CSP handling for v2 (form-action/plugin-types/frame-ancestors/reflected-xss)