set CSP in local test server

adding our CSP policy to the test server should help us seeing and avoiding CSP breakage.