Nick Sellen authored Dec 01, 2019 and Johannes committed Dec 06, 2019

A couple of changes:
- we always send CSP headers now
  previously we only did if CSP_REPORT_URI was defined in config
- we default to blocking violations
  previously defaulted to report-only mode
  you can turn on report only by setting CSP_REPORT_ONLY to true