Change CSP to allow eval for now

This is a very likely XSS attack vector that really should be closed.
I've opened an issue on visualsearch about it.

https://github.com/documentcloud/visualsearch/issues/117
Use the app base url for the notifications socket