content security policy

[glaszig]

as this engine depends on unsafe-inline and unsafe-eval in the script-src directives i decided to disable my csp only for this engine. to accomplish this i put the following into an initializer. with some more involved code one should be able to swap the existing policy in request.content_security_policy at runtime but i'll leave that to somebody else.

RedisAnalytics::Dashboard::Engine.class_eval do
  config.to_prepare do
    RedisAnalytics::ApplicationController.class_eval do
      content_security_policy false
    end
  end
end