Reshaping web defenses with strict Content Security Policy