http security: remove form-action from CSP definitions