Fix doc paths and add Content-Security-Policy header