allow configuration config.content_security_policy.enforce.policy