change Content-Security-Policy

lib/private/response.php