Emit a report-only Content-Security-Policy with nonced inline scripts

- dark-mode restore now travels nonced, the admin constants likewise
- AUTH_TOKEN deleted in favour of the csrf meta tag
- new report collector at /csp_reports

1 files changed, 5 insertions, 5 deletions

diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
index d7681aff..ca867ab8 100644
--- a/app/views/layouts/application.html.erb
+++ b/app/views/layouts/application.html.erb
@@ -18,12 +18,12 @@
     <%= auto_discovery_link_tag(:atom, '/rss/updates.xml', title: "ATOM") %>
     <%= auto_discovery_link_tag(:rss,  '/rss/updates.rdf', title: "RSS") %>
 
-    <script>
-      (function() { document.addEventListener("DOMContentLoaded", function() {
-        if (localStorage.getItem('override-prefers-color-scheme', false))
+    <%= javascript_tag nonce: true do %>
+      document.addEventListener("DOMContentLoaded", function() {
+        if (localStorage.getItem('override-prefers-color-scheme'))
           document.getElementById("light-mode").checked = true;
-      }); })();
-    </script>
+      });
+    <% end %>
 
   </head>