Content security policy script src attr July 8, 2019 16 32 64 128 Unrecognized content security policy directive script src attr Content spoofing poc Content-security-policy script-src *