Fix broken specs due to unfound constant

I guess in class methods, the `include Constants` isn't enough --
instead access `ENV_KEY` as `Constants::ENV_KEY`.  Alternatively, could
we `extend Constants`?
Add specs for ContentSecurityPolicy class methods