HTTP Security plug: make starting csp string generation more readable