late updating of CSP

* also removing of SITE_URL where 'self' is already specified
* based on http://www.w3.org/TR/CSP/ "the source expression 'self' represents the set of URIs which are in the same origin as the protected resource"
Its to ensure that out of a box on a developers machine CSP doesn't fail straight away. It does this because all the CSP rules are HTTPS, but most developers run the site using HTTP.