Hi - although you mention that you can implement a Content-Securty-Policy using the Custom Headers field it doesn't work since you somehow split the custom headers data on the ";"-character.
In a CSP the ";"-character must be used within the value to seperate the different directives (e.g. Content-Security-Policy: scripts-src 'self'; img-src 'self';style-src 'self'; etc)
Hence only the first directive you write is being output to the browser.
(Issue found on v9.17.4)
