wip csp header setting

conf/base.conf

@@ -257,6 +257,7 @@ security {
     base_url = ${net.base_url}
     email = ${net.email}
   }
+  csp_header = "Content-Security-Policy"
 }
 oauth {
   mongodb {

modules/security/src/main/Env.scala

@@ -50,6 +50,12 @@ final class Env(
   }
   import settings._
 
+  val cspHeaderSetting = settingStore[String](
+    "cspHeader",
+    default = config getString "csp_header",
+    text = "Send content security policy in this header".some
+  )
+
   val recaptchaPublicConfig = RecaptchaPublicConfig(
     key = config getString "recaptcha.public_key",
     enabled = config getBoolean "recaptcha.enabled"