Restricting form-action to 'self' in the content security policy prevented Chrome (and likely other browsers) from using !bangs on the home page. Fixes #408