Adding content security policy