Content security policy protects against cross site scripting by limiting what can be executed by the browser using a white list set of values like script-src
a) True
b) False