Google Fonts violates Content Security Policy

There are two things to fix here:

• Use https for the Google fonts link (https://fonts.googleapis.com/css?family=Whatever)
• Authorize https://fonts.googleapis.com in style-src directive and https://fonts.gstatic.com in font-src directive: "style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com"