Don't add CSP Headers if the don't exist

The local domain doesn't need to be added to CSP unless a CSP header already exists, otherwise we grab the existing CSP header and merge the local domain in.