Fix Content Security Policy directive

```
Refused to connect to 'https://fonts.googleapis.com/css?family=Share+Tech+Mono'
because it violates the following Content Security Policy directive: "default-src 'self' ws:".
Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.
```