Fix font import, add CSP and pretty-printing for dev env

This PR adds the Content-Security-Policy to the response headers. This helps prevent XSS attacks.

We also enable pretty HTML printing for development environments and fix the font import in the CSS file.