add safe sources for CSP to all domains, fixes #339