CORS and CSP headers (#1286)

* do in-app compression only for CLI

* CORS and CSP headers

* lint

* add --debug to targets

* lint

* fix botched merge with master

server/common/app_config.py

@@ -52,6 +52,7 @@ class AppConfig(object):
             self.server__open_browser = dc["server"]["open_browser"]
             self.server__about_legal_tos = dc["server"]["about_legal_tos"]
             self.server__about_legal_privacy = dc["server"]["about_legal_privacy"]
+            self.server__force_https = dc["server"]["force_https"]
             self.multi_dataset__dataroot = dc["multi_dataset"]["dataroot"]
             self.multi_dataset__index = dc["multi_dataset"]["index"]
             self.multi_dataset__allowed_matrix_types = dc["multi_dataset"]["allowed_matrix_types"]

server/common/default_config.py

@@ -12,6 +12,7 @@ server:
   open_browser: false
   about_legal_tos: null
   about_legal_privacy: null
+  force_https: false
 
 presentation:
   max_categories: 1000