This is required by the pdf viewer, since the files app on master uses the AppFramework it had applied the more strict defaults which made it not work on master.
1. Allows it to use the more secure CSP rules of the AppFramework. 2. Adds some unit tests.