Reining in the Web with Content Security Policy