If the app has the CSP disabled globally allow a controller action
to enable the policy for that request.