add missing CSP rule