remove reflected-xss CSP entry
remove reflected-xss CSP entry

Turns out the CSP entry has been deprecated in favour of the header,
even though the header was there before.

ndmitchell/hoogle,ndmitchell/hoogle,ndmitchell/hoogle