Testing for Content Security Policy weakness