Allow overriding/extending Content-Security-Policy in config

Signed-off-by: Jesse Stuart <jesse@jessestuart.ca>