tl;dr :forward_endpoint is used in the CSPController to forward the requests. FF_CSP_ENDPOINT represents the route to the CSPController

`:forward_endpoint` is used in the controller that forwards the csp reports. The constant represents the route that the report should post to from the browser. This logic is meant to say:

If you are on a different domain than your `:report-uri`* or `:report_uri` only contains a path, and you're using firefox, send the report back to my app so it can be forwarded to the value in `:forward_endpoint`

If no `:forward_endpoint` is supplied, assume you know what you're doing and understand that you may lose some firefox reports unless you're using a path. 

<rant>
It's so effing confusing that at one point I questioned what that setting meant (and the mean has mos definitely changed). Yay for 0.x releases. I think that entire section in the README needs to be rewritten, by someone other than me so it's comprehensible to at least two people.
</rant>

* fwiw This part of the code may become an edge case with the upcoming Firefox releases. Currently, TLD+1/scheme/port have to match but that may be changing to only require TLD+1 to match