enable content security policy for js, set correct encoding for text/html resources