ASP.NET Content Security Policy script-nonce support