Added
CSP_UPGRADE_INSECURE_REQUESTSenv var to control the CSPupgrade-insecure-requestsdirective. It defaults to the existing behaviour (on in production, off elsewhere); set it tofalsefor an HTTP-only deployment on a trusted private network, where the browser would otherwise upgrade the dashboard tohttpsand make it unreachable. Set it totrueto force it on. (#611)