batch 1 of changes to allow for Content-Security-Policy header