content-policy: whitelist mailto: urls