why use an array for CSP report URI?
Change iexss to xssFilter, because it's not just IE
contentTypeOptions -> nosniff
cacheControl -> nocache