simple testcase with content security policy