only disable csp when iframes are used