How about explicitly say there, that `enable_csp = false`, as default behaviour instructs? Otherwise it's hard to say is commented `true` reflects default value or not.