This reverts merge request !856 (merged)
This won't work. I thought Tae added everything but script-src was missing and we require unsafe-inline for the local development web server.
We will have to find a way to catch these issues in the CI/CD pipeline