fix copy and paste error on excluding content_security_policy as default