Called by:
Mobilizon.Web.Plugs.HTTPSecurityPlug.csp_string
(L86)