Mark *csp as immutable for is_untrusted_url()