Updated CSP headers and removed fast-render

There was a problem with logging in with the new CSP policy. I had to add unsafe eval because jquery uses a window.eval call.