Add proper Content-Security-Policy on Balrog admin's index page (#916)
Add proper Content-Security-Policy on Balrog admin's index page (#916)

* Add csp to index page.

* Add a comment to explain the reasoning behind the CSP.

* Fix connect-src.

* Minor comment tweak.

* Add frame-ancestors directive.

* Switch to default-src: none & remove frame-ancestors (because it can't be set through a <meta> tag)

* Use https for all img-src.

mozbhearsum/balrog,mozbhearsum/balrog,testbhearsum/balrog,mozbhearsum/balrog,testbhearsum/balrog,testbhearsum/balrog,mozbhearsum/balrog,testbhearsum/balrog