CSP: Mark 'child-src' and 'CSP' header as at risk.