Modify content security policy to allow wmflabs js and bits.orain images...

..., resolves #235 hopefully