first step implementing content security protection

http header preventing unsafe content loading will be implemented for
2.0