move the CSP into its own file and add tests