Fixed security issue and noscript iframe

app/__init__.py

@@ -169,6 +169,10 @@ def _csp(config):
 
 
 def create_app(application):
+    @application.after_request
+    def add_csp_header(response):
+        response.headers['Content-Security-Policy'] = "frame-src https://www.googletagmanager.com"
+        return response
     # @application.context_processor
     # def inject_feature_flags():
     # this is where feature flags can be easily added as a dictionary within context