move built-in CSP violation-report server into routes.js
CSP stuff: use logger, not console.log