diff --git a/app/javascript/gabsocial/components/icon_button.js b/app/javascript/gabsocial/components/icon_button.js
index e30702d1..bfc10db8 100644
--- a/app/javascript/gabsocial/components/icon_button.js
+++ b/app/javascript/gabsocial/components/icon_button.js
@@ -23,6 +23,7 @@ export default class IconButton extends React.PureComponent {
     animate: PropTypes.bool,
     overlay: PropTypes.bool,
     tabIndex: PropTypes.string,
+    type: PropTypes.string,
   };
 
   static defaultProps = {
@@ -64,6 +65,7 @@ export default class IconButton extends React.PureComponent {
       pressed,
       tabIndex,
       title,
+      type,
     } = this.props;
 
     const classes = classNames(className, 'icon-button', {
@@ -106,6 +108,7 @@ export default class IconButton extends React.PureComponent {
             style={style}
             tabIndex={tabIndex}
             disabled={disabled}
+            type={type}
           >
             <Icon id={icon} style={{ transform: `rotate(${rotate}deg)` }} fixedWidth aria-hidden='true' />
           </button>
diff --git a/app/javascript/gabsocial/features/account/components/header.js b/app/javascript/gabsocial/features/account/components/header.js
index 4e53b7fa..58296983 100644
--- a/app/javascript/gabsocial/features/account/components/header.js
+++ b/app/javascript/gabsocial/features/account/components/header.js
@@ -138,7 +138,6 @@ class Header extends ImmutablePureComponent {
       menu.push({ text: intl.formatMessage(messages.blocks), to: '/blocks' });
       menu.push({ text: intl.formatMessage(messages.domain_blocks), to: '/domain_blocks' });
     } else {
-      menu.push({ text: intl.formatMessage(messages.chat), action: this.onChat });
       menu.push({ text: intl.formatMessage(messages.mention, { name: account.get('acct') }), action: this.props.onMention });
 
       if (account.getIn(['relationship', 'following'])) {
@@ -338,7 +337,16 @@ class Header extends ImmutablePureComponent {
                   </Button>
                 }
                 {account.get('id') !== me &&
-                  <IconButton icon='comments' className='button button-alternative-2 chat-button hidden-sm' onClick={this.onChat} title={intl.formatMessage(messages.chat)} />
+                  <form method='POST' action='https://chat.gab.com/direct-message'>
+                    <input type="hidden" name="username" value={account.get('username')} />
+                    <IconButton
+                      type='submit'
+                      icon='comments'
+                      className='button button-alternative-2 chat-button'
+                      onClick={this.onChat}
+                      title={intl.formatMessage(messages.chat)}
+                    />
+                  </form>
                 }
                 <DropdownMenuContainer items={menu} icon='ellipsis-v' size={24} direction='right' />
               </div>
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index 5f3f83b5..9c523e09 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -20,11 +20,11 @@ Rails.application.config.content_security_policy do |p|
   if Rails.env.development?
     webpacker_urls = %w(ws http).map { |protocol| "#{protocol}#{Webpacker.dev_server.https? ? 's' : ''}://#{Webpacker.dev_server.host_with_port}" }
 
-    p.connect_src :self, :blob, assets_host, Rails.configuration.x.streaming_api_base_url, *webpacker_urls
-    p.script_src  :self, :unsafe_inline, :unsafe_eval, assets_host
+    p.connect_src :self, :blob, assets_host, Rails.configuration.x.streaming_api_base_url, *webpacker_urls, "https://*.gab.com"
+    p.script_src  :self, :unsafe_inline, :unsafe_eval, assets_host, "https://*.gab.com"
   else
-    p.connect_src :self, :blob, assets_host, Rails.configuration.x.streaming_api_base_url
-    p.script_src  :self, assets_host
+    p.connect_src :self, :blob, assets_host, Rails.configuration.x.streaming_api_base_url, "https://*.gab.com"
+    p.script_src  :self, assets_host, "https://*.gab.com"
   end
 end