Added some XSS protection via Content-Security-Policy header