add meta Content-Security-Policy to force upgrade-insecure-requests

[elmarzouguidev]

This PR is to prevent this error :

Mixed Content: The page at 'X' was loaded over HTTPS, but requested an insecure element (HTTP)