fix CSP for Fauxton dev mode

The ace editor uses data: to load images - so we have to allow for that. The same would apply when serving fauxton out of CouchDB w/out node.js. This PR fixes the node.js-based dev mode (grunt dev). Hope this is the one this time