Modify content security policy to allow wmflabs js and bits.orain images, resolves #235 hopefully