Content Security Policy header containing "frame-src {{GET[frame_src_policy]}}"