SSO: add CSP policy 'form_action: *'

The OAuth2 workflow demands that a POST request be made back to the
requesting application. That request is currently blocked by CSP.