blurb = The default Content-Security-Policy is currently overridden using the <code>hudson.model.DirectoryBrowserSupport.CSP</code> system property, which is a potential security issue when browsing untrusted files. \
  As an alternative, you can set up a <strong>resource root URL</strong> that Jenkins will use to serve some static files without adding <code>Content-Security-Policy</code> headers.
