MediaProxy responses now return a sandbox CSP header