content security policy bullpen