Tighten up Content Security Policy
Tighten up Content Security Policy

I decided to move away from using CDN's (to augment user privacy), so
we're closer to being able to require all scripts being hosted on
'self'.

Unfortunately, `unsafe-eval` and `unsafe-inline` will have to romain for
some time:

- Djangular makes use of inline styles and JavaScript
- Sentry uses eval
- FontAwesome uses inline styles and eval JavaScript by default
  (although I found a way to configure things such that it does not)

DavidCain/mitoc-ansible,DavidCain/mitoc-ansible,DavidCain/mitoc-ansible