made a start at plumbing nonce support in
added a context processor to get csp_nonce in the request