Modify CSP header to allow script injection from harvestapp.com

Been using it for some time now. Just tested again, seems to work fine in Chrome 30.