add connect-src contentSecurityPolicy