add fonts.gstatic.com to csp header