CSP header should be added by httpd.
Add CSRF protection