Remove child-src CSP policy (deprecated)

http/response/builder.go

@@ -96,7 +96,7 @@ func (b *Builder) writeHeaders() {
 	b.headers["X-XSS-Protection"] = "1; mode=block"
 	b.headers["X-Content-Type-Options"] = "nosniff"
 	b.headers["X-Frame-Options"] = "DENY"
-	b.headers["Content-Security-Policy"] = "default-src 'self'; img-src *; media-src *; frame-src *; child-src *"
+	b.headers["Content-Security-Policy"] = "default-src 'self'; img-src *; media-src *; frame-src *"
 
 	for key, value := range b.headers {
 		b.w.Header().Set(key, value)

http/response/builder_test.go

@@ -32,7 +32,7 @@ func TestResponseHasCommonHeaders(t *testing.T) {
 		"X-XSS-Protection":        "1; mode=block",
 		"X-Content-Type-Options":  "nosniff",
 		"X-Frame-Options":         "DENY",
-		"Content-Security-Policy": "default-src 'self'; img-src *; media-src *; frame-src *; child-src *",
+		"Content-Security-Policy": "default-src 'self'; img-src *; media-src *; frame-src *",
 	}
 
 	for header, expected := range headers {