Update RequestsController.php

Unsets the Content-Security-Policy "inside" the iframe. The iframe will be loaded with user's CSP, but doesn't need any CSP inside the iframe as it will just be used in development. Force unset, as it could be set anywhere else in the user's original application.

Author: TheFRedFox

src/Controller/RequestsController.php

@@ -37,7 +37,7 @@ public function beforeFilter(Event $event)
             throw new NotFoundException();
         }
 
-        $this->response->header(['Content-Security-Policy' => "default-src 'self'; style-src 'self' fonts.googleapis.com; font-src 'self' fonts.gstatic.com"]);
+        $this->response->header(['Content-Security-Policy' => '']);
     }
 
     /**