fix(server): Add a 'connect-src' directive to allow contact with the aut...

...h-server

fixes #1253 

@warner, @zaach - could I get an r? Docs for `connect-src` are [on MDN](https://developer.mozilla.org/en-US/docs/Web/Security/CSP/CSP_policy_directives#connect-src).
As per @warner's comment, we could put a conditional here and only use the middleware while in development mode.