add optional content security policy header