CSP middleware cleanup based on @warner's feedback.

* Only add the CSP middleware in dev mode.
* Simplify the requiresCsp check - url.parse is not needed, express already has req.path