mozilla/fxa-content-server — pull request #1248 by warner (2014-06-16 21:54:05+00:00)
Title: add Content-Security-Policy headers when in dev mode

When this is active, the server accepts violation reports via POSTs to
/_/csp-violations, and the CSP header points to that URL, so devs can
see problems immediately.

The patch also includes a small standalone reporting server which can be
used as the target of externally-added CSP headers (e.g. when nginx is
configured to add them). Staging/production deployments will use this,
instead of the built-in endpoint.