(If you are using the subpath config, you can ignore all this.) Because the config includes Content-Security-Policy which reduces risk of XSS, you need to add the URL from the skin repo and the fonts ...