update userpage csp to allow eval