removed use of request.META in favour of request_csp_nonce attr