Enable CSP differently for tests.

Avoids header and meteor_runtime_config.js being used on tests.