Emit a report-only Content-Security-Policy with nonced inline scripts

- dark-mode restore now travels nonced, the admin constants likewise
- AUTH_TOKEN deleted in favour of the csrf meta tag
- new report collector at /csp_reports

1 files changed, 2 insertions, 4 deletions

diff --git a/public/javascripts/admin_interface.js b/public/javascripts/admin_interface.js
index c0e2d9c..b7bdc10 100644
--- a/public/javascripts/admin_interface.js
+++ b/public/javascripts/admin_interface.js
@@ -82,10 +82,8 @@ $(document).ready(function () {
   });
 
   $(document).ajaxSend(function(event, request, settings) {
-    if (typeof(AUTH_TOKEN) == "undefined") return;
-    // settings.data is a serialized string like "foo=bar&baz=boink" (or null)
-    settings.data = settings.data || "";
-    settings.data += (settings.data ? "&" : "") + "authenticity_token=" + encodeURIComponent(AUTH_TOKEN);
+    var meta = document.querySelector("meta[name='csrf-token']");
+    if (meta) request.setRequestHeader("X-CSRF-Token", meta.content);
   });
 
 });