fix CSP for Fauxton dev mode
Merge remote-tracking branch 'origin/2160-fix-csp' into 2160-fix-csp