Manage Content-Security Policy headers better