discourse/spec/lib/content_security_policy