adds pretender and content security policy which may not be needed