Merge "Initial support for Content Security Policy, disabled by default"