Move Content-Security-Policy-Report-Only above Content-Security-Policy to avoid parse bug