fix(client,server): correct CSP setting