fix($parse): correctly detect CSP mode via $sniffer

Also fixes the test suite, which was not actually taking CSP-mode paths when
we were expecting it to.

Numerous CSP-mode tests are failing, working on fixing these.
I'm supporting the primitive `csp` just in case anyone is depending on that via decorators or something