Refactor build and CSP headers for Safari compat (#1442)

* add unsafe-inline directive to style-src

* debugging - turn on csp reporting

* revert reporting only csp

* do not inline JS and CSS in build

* enable HTTPs only when in production mode

* remove debug printf

* fix clean target

* revert force_https removal

client/index_template.html

@@ -52,10 +52,11 @@
     <div id="root"></div>
     {% for script in SCRIPTS %}
     <script type="text/javascript" src="{{script | safe}}"></script>
-    {% endfor %} {% for ils in INLINE_SCRIPTS %}
-    <script type="text/javascript">
-      {% include ils %}
-    </script>
+    {% endfor %}
+
+    {% for ils in INLINE_SCRIPTS %}
+    <!-- caution: do not change white space in this script element -->
+    <script type="text/javascript" no-csp-hash>{% include ils %}</script>
     {% endfor %}
   </body>
 </html>