#28 add csp lockdown policy