late updating of CSP

* also removing of SITE_URL where 'self' is already specified
* based on http://www.w3.org/TR/CSP/ "the source expression 'self' represents the set of URIs which are in the same origin as the protected resource"
Is all of this just to avoid something like this in the settings file?

   CSP_SCRIPT_SRC = CSP_SCRIPT_SRC + (STATIC_URL[:-1],)