The default CSP is only helpful for some, and can break instances for
others. Since these aren't always necessary and are occasionally set by
the user's preferred reverse proxy, it is being disabled unless
explicitly enabled by setting `WHOOGLE_CSP`.
Fixes#493
Renamed to avoid collision issues for users who update the env file when
running their instance.
Non-template env file is gitignored to avoid accidental tracking.
Fixes#467