Remove form action from csp

Restricting form-action to 'self' in the content security policy
prevented Chrome (and likely other browsers) from using !bangs on the
home page.

Fixes #408

app/__init__.py

@@ -75,8 +75,7 @@ app.config['CSP'] = 'default-src \'none\';' \
                     'style-src \'self\' \'unsafe-inline\';' \
                     'script-src \'self\';' \
                     'media-src \'self\';' \
-                    'connect-src \'self\';' \
-                    'form-action \'self\';'
+                    'connect-src \'self\';'
 
 if not os.path.exists(app.config['CONFIG_PATH']):
     os.makedirs(app.config['CONFIG_PATH'])