fix: update handler csp to enforce https

[bpeng]

Proposed Changes

Resolves #.

Changes proposed in this pull request:

• csp without specifying https will drag the web security score down

Production Changes

The following production changes are required to deploy these changes:

• None

Review

Check the box that applies to this code review. If necessary please seek help with adding a checklist guide for the reviewer.
When assigning the code review please consider the expertise needed to review the changes.

• This is a content (documentation, web page etc) only change.
• This is a minor change (meta data, bug fix, improve test coverage etc).
• This is a larger change (new feature, significant refactoring etc). Please use the code review guidelines to add a checklist below to guide the code reviewer.

Code Review Guide

Insert check list here if needed.

[junghao]

Looks good