Emit a report-only Content-Security-Policy with nonced inline scripts

- dark-mode restore now travels nonced, the admin constants likewise
- AUTH_TOKEN deleted in favour of the csrf meta tag
- new report collector at /csp_reports

1 files changed, 8 insertions, 0 deletions

diff --git a/test/controllers/csp_reports_controller_test.rb b/test/controllers/csp_reports_controller_test.rb
new file mode 100644
index 0000000..7dd8c9e
--- /dev/null
+++ b/test/controllers/csp_reports_controller_test.rb
@@ -0,0 +1,8 @@
+require 'test_helper'
+
+class CspReportsControllerTest < ActionController::TestCase
+  test "accepts anonymous reports without CSRF" do
+    post :create, body: '{"csp-report":{"violated-directive":"script-src"}}'
+    assert_response :no_content
+  end
+end