add CSP header, config knobs, and a small reporting server

And a minimal test that confirms the CSP header is present when it's
supposed to be.