fixed Content-Security-Policy HTTP-header