ContentSecurityPolicy: Add trailing & to report urls