clarified CSP constraints for manifests (closes #263)

rewrote csp text to assume *
Added CSP security consideration (closes #262)