nginx config: make sure the security-policy is sent also