This header is supposed to be included so the test case can assert that it has no effect (the Core rendering service overrides it with its own header). So you should add this back in:    ```suggestion                    'content-security-policy': "script-src 'unsafe-eval'",                    'x-kibana': '42',  ```