@Test
void skipCSP() {

    interceptor.contentSecurityPolicy = null;
    when(response.contentType()).thenReturn(Optional.of(ContentType.TEXT_HTML));
    interceptor.appendSecurityHeaders(response);
    verify(response, never()).header(eq("Content-Security-Policy"), anyString());
}