Set the content security policy