question and answer about content-security-policy