settings: Don't enable CSP by default