Content Security Policy

[jmfield2]

Since the webapp frontend makes heavy use of Javascript it would be nice to incorporate a CSP policy for proactive security..

There are tools to create a basic policy, and one might look like this:

allow 'self'; img-src 'self' api.mapbox.com; 
script-src www.google-analytics.com 'self' storage.googleapis.com ; 
style-src fonts.googleapis.com 'self' api.mapbox.com storage.googleapis.com cdn.materialdesignicons.com;

We just have to add this to the "Content-Security-Policy" HTTP header