fix(server): Add a 'connect-src' directive to allow contact with the auth-server and oauth-server

fixes #1253
Extract csp middleware logic into its own file.

* Update the tests to ensure CSP is served when expected.
CSP middleware cleanup based on @warner's feedback.

* Only add the CSP middleware in dev mode.
* Simplify the requiresCsp check - url.parse is not needed, express already has req.path
Merge pull request #1254 from mozilla/issue-1253-csp-blocks-auth-server

fix(server): Add a 'connect-src' directive to allow contact with the aut...