fix(csp): turn on report only mode until CSP issues are resolved

We should fix the CSP errors, but currently it's difficult for anyone to work on anything else while CSP is enforced. We can turn enforcement back on once the issues are resolved.

@vladikoff r?

cc @warner