Disable CSP, as it caused breakage on FxOS

[callahad]

Fixes #4144

Leaving comments in each file to avoid future well-intentioned changes breaking
it again.

CSPs were introduced in commit 0e0f47b

[callahad]

All tests pass locally.

...waits for Travis...

[jaredhirsch]

Should we also remove the csp key from lib/configuration.js?

[callahad]

I think not, since it's a known-good CSP, that happens to just be untenable on FxOS.

[jaredhirsch]

Hmm, having trouble logging in on localhost after this change

[jaredhirsch]

I'm getting an unrelated bidbundle error locally, r+, merging

[shane-tomlinson]

Could you do something like enable CSP for all known good browsers and disable for FxOS?

[shane-tomlinson]

You could also set CSP to report-only to see which browsers CSP causes issues in.

See https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Using_Content_Security_Policy#Testing_your_policy