code: function (res, path) {
                  let defaultSrc = "default-src 'self';";
                  let styleSrc = "style-src 'self' fonts.googleapis.com;";
                  let fontSrc = "font-src 'self' fonts.gstatic.com;";
                  let imgSrc = "img-src 'self' www.gravatar.com;";
                  res.setHeader('Content-Security-Policy', `${defaultSrc} ${styleSrc} ${fontSrc} ${imgSrc}`);
                }
docs: add CSP header to ensure spin.js supports it