changed the CSP URLs in csp.default.properties
tightened check for invalid gift codes