List policies in a list instead of a long string

Instead of:

    'script-src': "'self' https://cdn.mxpnl.com https://cdn.foobar.com"

Do:

    'script-src': ["'self'",
                   "https://cdn.mxpnl.com",
                   "https://cdn.foobar.com"]