Content Security Policy Tomcat 8