Cloudflare not passing Content-Security-Policy Headers