Emit a report-only Content-Security-Policy with nonced inline scripts

- dark-mode restore now travels nonced, the admin constants likewise
- AUTH_TOKEN deleted in favour of the csrf meta tag
- new report collector at /csp_reports

1 files changed, 2 insertions, 0 deletions

diff --git a/config/routes.rb b/config/routes.rb
index f3893266..3aa5c69b 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -9,6 +9,8 @@ Cccms::Application.routes.draw do
       defaults: { page_path: ['home'] },
       constraints: { locale: /de|en/ }
 
+  post 'csp_reports' => 'csp_reports#create'
+
   # All application routes are scoped under an optional two-letter locale
   # prefix: /de/... and /en/... Both forms are valid; the prefix is omitted
   # for the default locale (:de) in generated URLs via default_url_options