fix(server): Add a 'connect-src' directive to allow contact with the aut...

...h-server

fixes #1253 

@warner, @zaach - could I get an r? Docs for `connect-src` are [on MDN](https://developer.mozilla.org/en-US/docs/Web/Security/CSP/CSP_policy_directives#connect-src).
url.parse can except if req.url is invalid. Do we care?