Anyone have expertise with HTTP headers, specifically Content-Security-Policy? I'm trying to set CSP on a couple of sites, to improve protection to a hosted application, and running into issues with ...