added Content-Security-Policy headers