removed security policy so that helper is executed for all webpages -- not for upstream