Add Content-Security-Policy, limit content to same origin.