alter CSP settings later

you can't put this here because the web server never calls manage.py. You could put it right after this: https://github.com/mozilla/webpay/blob/master/webpay/urls.py#L11