Standard header only

Rips out all browser-specific CSP handling and only serves the standard header.

A followup: I'd like to rip out the brwsr gem and not do any UA sniffing. This will mean more headers are sent...