Doing it out of the middleware would avoid parsing the `STATIC_URL` setting at each request. Actually I'm wondering if a middleware is the right place, maybe `csp.__init__.py` is more appropriated to enrich `CSP_*` settings on load?