--- a/mercurial/hgweb/request.py	Mon Apr 30 17:22:20 2018 -0700
+++ b/mercurial/hgweb/request.py	Mon Apr 30 17:28:59 2018 -0700
@@ -473,6 +473,7 @@
                           if k.lower() not in ('date', 'etag', 'expires',
                                                'cache-control',
                                                'content-location',
+                                               'content-security-policy',
                                                'vary')}
             if badheaders:
                 raise error.ProgrammingError(