I have this warning in the console when the AJAX request hits the 302:

    CSP WARN: The directive default-src http://fireplace.local:80 has been violated by http://mozilla.com.test.bango.org... 

I'm not familiar with protections specific to zamboni, do I have to add an exception somewhere?