Content-Security-Policy: Set base-uri none.

Author: stefansundin

config/initializers/10-secure_headers.rb

@@ -18,6 +18,7 @@
   config.referrer_policy = "no-referrer"
   config.csp = {
     default_src: %w('none'),
+    base_src: %w('none'),
     script_src: SecureHeaders::OPT_OUT,
     upgrade_insecure_requests: true,
   }