late updating of CSP

* also removing of SITE_URL where 'self' is already specified
* based on http://www.w3.org/TR/CSP/ "the source expression 'self' represents the set of URIs which are in the same origin as the protected resource"
We actually got rid of all these rules for AMO with the idea that pushing something, even a minimal set, was better than nothing because otherwise we got too many false positives and it was too much maintenance.  We ended up with just CSP_SCRIPT_SRC and CSP_FRAME_SRC but we were willing to drop CSP_FRAME_SRC too.  I mean, CSP_IMG_SRC is nice in theory, but there isn't much of an attack vector there.  Same for STYLE.  So, if there is any frustration around them all, feel free to drop everything except CSP_SCRIPT_SRC.