Add CSP headers to prevent XSS