HTTP Security plug: rewrite &csp_string/0