Update content security policy rules

Allow omdb, media-imdb and firebase sources
I had to add a 3rd option to the 'script-src' policy to get rid of all errors:
'script-src': "'self' 'unsafe-eval' https://cdn.firebase.com",