We scan thousands of CSP headers. These are the mistakes that come up over and over — and they're all fixable.