CSP: Block redirects by default, introduce 'unsafe-redirect'.