CSP policy bug