Added Content-Security-Policy, but its a bit to much work to make it work properly so its comment out.