Middleware to add Content-Security-Policy header