CSP 1.1: Change 'none-when-insecure' to 'none-when-downgrade'.