Always add CSP report-uri if enabled but not enforced