::SecureHeaders::Configuration.configure do |config|
  config.hsts = {max_age: 20.years.to_i, include_subdomains: true}
  config.x_frame_options = 'DENY'
  config.x_content_type_options = 'nosniff'
  config.x_xss_protection = {value: 1, mode: 'block'}
  config.csp = {
    enforce:      true,
    default_src:  'https://* self',
    report_uri:   '/content_security_policy/forward_report'
  }
end

::SecureHeaders::Configuration.configure do |config|
  config.hsts = {max_age: 20.years.to_i, include_subdomains: true}
  config.x_frame_options = 'DENY'
  config.x_content_type_options = 'nosniff'
  config.x_xss_protection = {value: 1, mode: 'block'}
  config.csp = {
    enforce:      true,
    default_src:  'https://* self',
    style_src:    'https://* self inline',
    report_uri:   '/content_security_policy/forward_report'
  }
end

Allow inline CSS, for now.
Allow inline CSS, for now.

The form_for helper in the picture upload form generates a
<div style="display:none"> tag around the utf8 and authenticity_token input
fields.
