late updating of CSP

* also removing of SITE_URL where 'self' is already specified
* based on http://www.w3.org/TR/CSP/ "the source expression 'self' represents the set of URIs which are in the same origin as the protected resource"
comment makes this confusing