* Initial secure header functionality
* Add unsafe-inline to csp
* Secure cookies
* Add connect-src
* Only run secure header config in prod (for now)
* Change prod check to within default
* Change from secure_headers to rails config
* Wrap behind production check
* Adapt dev env to run on a remote box
* webpack-dev-server ignores CLI arguments, so switched to environment
variables.
* Dynamically determine remote webpack host via APP_DOMAIN environment
variable, defined in application.yml.
* Setup content security policy to allow connecting to webpack on a
remote box, defined by APP_DOMAIN environment variable.
* Make Webpacker listen on 0.0.0.0
* Account for APP_DOMAIN port
* Add support for URI scheme and tests
* Fix a spec by disabling a Rubocop linter
