Use report-to exclusively in CSPs

Author: labkey-adam

api/src/org/labkey/filters/ContentSecurityPolicyFilter.java

@@ -203,8 +203,6 @@ private void extractCspVersion(String s)
         }
     }
 
-    private static final String X_FRAME_OPTIONS_HEADER_NAME = "X-Frame-Options";
-
     @Override
     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException
     {
@@ -231,15 +229,7 @@ private String getSubstitutedCsp(HttpServletRequest req)
 
         if (getType() != ContentSecurityPolicyType.Enforce || !OptionalFeatureService.get().isFeatureEnabled(FEATURE_FLAG_DISABLE_ENFORCE_CSP))
         {
-            Map<String, String> map = Map.of(NONCE_SUBST, getScriptNonceHeader(req));
-            String csp = expression.eval(map);
-
-            if ("https".equals(req.getScheme()))
-            {
-                csp = csp + " report-to csp-report ;";
-            }
-
-            return csp;
+            return expression.eval(Map.of(NONCE_SUBST, getScriptNonceHeader(req)));
         }
 
         return null;