HTTP header Content-Security-Policy parsing