gustafn
committed
on 12 Sep 16
-- handle ie 11 (uses a different header field for CSP)
- move CSP generation to the end