set contentSecurityPolicy to report only
update app style