code: function cspFactory(options, reportOnly) {
    options = options || {};
    if (isString(options)) {
      options = { policy: options, reportOnly: !!reportOnly };
    }
    var headers = options.headers ||
      (options.reportOnly && REPORT_ONLY_HEADERS) || HEADERS;
    var policy = options.policy || DEFAULT;
    policy = toHeader(policy);
    return function csp(req, res, next) {
      headers.forEach(function(header) {
        res.setHeader(header, policy);
      });
      next();
    };
  }
docs: csp({ policy: {src: value}) csp({ policy: {src: [values]}) csp({ policy: policyStr }) csp(policyStr, reportOnly)