This PR was merged into the 3.2 branch.Discussion----------Don't add csp-headers if none are required| Q             | A| ------------- | ---| Branch?       | 3.2| Bug fix?      | yes| New feature?  | no| BC breaks?    | no| Deprecations? | no| Tests pass?   | yes| Fixed tickets | This PR is also the ticket| License       | MITIn 3.2 a tool to adjust Content Security Policy headers in combination with the WebProfiler was added. We encountered a bug in its behavior.We had CSP-headers that did not have a script-src/style-src nor a default-src (it was something like `form-action: https:`). In that scenario, the ContentSecurityPolicyHandler would add `script-src: 'unsafe-inline' 'nonce-....'`, but that would actually change the "everything is allowed scenario" into "only inline and nonce-... is allowed". The result was _only_ the javascript of WebProfiler was allowed, rather than everything.This PR fixes the scenario where no default-src nor a script-src/style-src is provided. It simply continue's rather than treats it as an empty list of rules that need additional rules.~A bug I did find, but not fix, is the fact that that `'unsafe-inline'` is ignored in at least Firefox and Chrome due to the fact there is also a nonce-element in the rule.~Commits-------6fecc94 Don't add csp-headers if none are required