Used to set respose header: Content-Security-Policy