CSP using Spring Security