Fix CSP handling (#4449)

* Change incompatible module and fix a memory leak in the process

* Fix fonts, allow websocket

* Oops fix a brainfart with using the hostname

* Don't inlude null hostname

* Update the shrinkwrap

* Instantiate new cache if new instance of profile code is created. Calculate IOB with three digit precision to keep tests happy (and this is roughly the precision we're operating at anyway).

* - implement @jweismann suggestions https://github.com/nightscout/cgm-remote-monitor/pull/4449#issuecomment-469868508
- add frameAncestors, baseUri and formAction protection

* update README and run doctoc

* fix reportOnly

* add objectSrc

* Use modern CSS loading

* Change CSS to use the "official" async loading across the board (which hopefully plays nicer with CSP)

* first release candiate for 0.11.2 with Minimed EU Server and Guardian Connect integration

- integrates https://github.com/mddub/minimed-connect-to-nightscout/pull/11 into Nightscout

* bump node 10 LTS version

* increase logging, fix /swagger.yaml

* fix typo

* set version to rc2, update mongodb to 3.2.2

* add SECURE_CSP_REPORT_ONLY (default false).

* npm update and revert to requiring Node versions without security issues.

CONTRIBUTING.md

@@ -3,11 +3,12 @@
 **Table of Contents**
 
 - [Contributing to cgm-remote-monitor](#contributing-to-cgm-remote-monitor)
-  - [Design](#design)
+  - [Design & new features](#design--new-features)
   - [Develop on `dev`](#develop-on-dev)
   - [Style Guide](#style-guide)
   - [Create a prototype](#create-a-prototype)
   - [Submit a pull request](#submit-a-pull-request)
+  - [Bug fixing](#bug-fixing)
   - [Comments and issues](#comments-and-issues)
   - [Co-ordination](#co-ordination)
   - [Other Dev Tips](#other-dev-tips)