Exclude horizon routes from CSP headers

For me CSP breaks horizon, and according to the github issue it is expected that horizon is only used internally and no CSP headers are applied.

Differential Revision: https://git.kolab.org/D4082