Fix loading env configs
Update security headers
Set csp config in production