Use str_replace instead of RegExp to set nonce in CSP()