class Rack::Protection::ContentSecurityPolicy

def call(env)
  status, headers, body = @app.call(env)
  header = options[:report_only] ? 'content-security-policy-report-only' : 'content-security-policy'
  headers[header] ||= csp_policy if html? headers
  [status, headers, body]
end