All: switch to enforced CSP header

Ref jquery/infrastructure-puppet#54

themes/jquery/functions.php

@@ -289,7 +289,7 @@ function jq_content_security_policy() {
 	}
 
 	header( 'Reporting-Endpoints: csp-endpoint="' . $report_url . '"' );
-	header( 'Content-Security-Policy-Report-Only: ' . $policy_string );
+	header( 'Content-Security-Policy: ' . $policy_string );
 }
 
 add_action( 'send_headers', 'jq_content_security_policy' );