More tweaks, force content security policy to allow api calls.