v2.0.18

CSP: Added the frame-src directive and fixed syntax issues in the header. It is now possible to leave a directive empty, in which case the default values from default-src are used.