update csp per @dstufft's suggestion