Adding the Content-Security-Policy header