Fix CSP header, but Firefox doen't work