Initial support for Content Security Policy, disabled by default