It was impossible to override the default-src CSP rule inside a plugin. This commit fixes this limitation by moving the assignation of the rule from Response class to ClassProvider.