fix content security policy