Adding file metadata for Content-Security-Policy

Has anyone tried to add Content-Security-Policy before? I am trying to add it via metadata.json file.

To be honest, I am running into a strange problem:

      [
       {
        "path": "<REALM_APP_DOMAIN>/index.html",
        "attrs": [
        {
          "name": "Content-Security-Policy",
           "value": "frame-ancestors 'self'"
      }
    ]
  }
]

This results in error:

  push failed: file '***.mongodbstitch.com/index.html' has an entry in metadata file, but does not appear in 
  files directory

I know that index file is there so… am I referencing it wrong? I tried a custom domain but that didn’t work either. I also tried just index.html. This should just relative urls if you ask me anyway… What if I dev/stg/prd environments? Having the realm domain in there is a bust for that.

Bumping this. Does anyone have any ideas?