changed CSP default to true