WP customizer + gulp + browsersync = refused to display in iframe?

Found a work around by adding ‘ localhost:3000’ to the ‘Content-Security-Policy’ header:

function edit_customizer_headers () {
  function edit_csp_header ($headers) {
    $headers['Content-Security-Policy'] .= ' localhost:3000';
    return $headers;
  }
  add_filter('wp_headers', 'edit_csp_header');
}
add_action('customize_preview_init', 'edit_customizer_headers');