Lack of CSP headers

[Spartwo]

ZAP has highlighted the lack of CSP headers as a potential security flaw. Place headers into the appropriate areas to patch up this potential vulnerability.

[Spartwo]

CSP header initialised in app.js but zap still states it as missing in some pages