fix(csp): turn on report only mode until CSP issues are resolved
fix(oauth): keep the oauth context after a page refresh
Update CONTRIBUTING.md
Merge pull request #1257 from mozilla/issue-1251-oauth-refresh

fix(oauth): keep the oauth context after a page refresh
tweaking json in markdown
Merge pull request #1261 from pdehaan/readme-json

tweaking json in markdown
Merge pull request #1255 from mozilla/csp-report-only

fix(csp): turn on report only mode until CSP issues are resolved.

I'm going to merge this until we have all the problems figured out. Thanks @zaach!
fix(server): Add a 'connect-src' directive to allow contact with the auth-server and oauth-server

fixes #1253
Extract csp middleware logic into its own file.

* Update the tests to ensure CSP is served when expected.