CSP: Allow self as manifest-src

Chrome complains otherwise, as it can't download the Web Manifest.

Signed-off-by: David Mehren <git@herrmehren.de>

lib/csp.js

@@ -8,6 +8,7 @@ const defaultDirectives = {
   baseUri: ['\'self\''],
   connectSrc: ['\'self\''],
   fontSrc: ['\'self\''],
+  manifestSrc: ['\'self\''],
   frameSrc: ['\'self\'', 'https://player.vimeo.com', 'https://www.slideshare.net/slideshow/embed_code/key/', 'https://www.youtube.com'],
   imgSrc: ['*'], // we allow using arbitrary images
   scriptSrc: [