add CSP header, config knobs, and a small reporting server