Extract csp middleware logic into its own file.

* Update the tests to ensure CSP is served when expected.