relax CSP to allow expected iframe and bootstrap inline svg
relax CSP to allow expected iframe and bootstrap inline svg

Also should not apply CSP two times (by header and meta tag).
Report-Only for development, block violations in tests.

kaliber5/ember-bootstrap,jelhan/ember-bootstrap,kaliber5/ember-bootstrap,jelhan/ember-bootstrap