adding CSP policy to test/index.html (via meta tag) and server.js