Fix CSP headers for remote instance

Fixes images, custom styles, custom fonts and music playback from remote instances.

The previous CSP header config disallowed all those things whenever we've used a remote instance.