Fix content security policy

[samhstn]

Currently we have the following console errors when visiting any of our routes:

Refused to apply inline style because it violates the following Content Security Policy directive:
"default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-4Supq/s1K...n4/KQ='),
or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src'
was not explicitly set, so 'default-src' is used as a fallback.

Need to investigate how to fix this.