Merge #4781

4781: fix: ensure proper content-security policy. r=jniles a=jniles

Fixes the upgrade of helmet that changed the default content-security policy.  Now the application renders properly.

Co-authored-by: Jonathan Niles <jonathanwniles@gmail.com>

server/config/express.js

@@ -40,7 +40,7 @@ exports.configure = function configure(app) {
   debug('configuring middleware.');
 
   // helmet guards
-  app.use(helmet());
+  app.use(helmet({ contentSecurityPolicy : { directives : { defaultSrc : ['\'self\'', '\'unsafe-inline\''] } } }));
 
   app.use(bodyParser.json({ limit : '8mb' }));
   app.use(bodyParser.urlencoded({ extended : false }));