Fix CSP directive in production

[gbrodman]

In prod, when loading the console, we were failing to get some
scripts/styles with the error "Executing
inline event handler violates the following Content Security Policy directive 'script-src
'self''. Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-
...') is required to enable inline execution. Note that hashes do not apply to event
handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword
is present. The action has been blocked."

We fix this by disabling inline-critical optimization for prod in the
angular file.

In addition, the web.xml header values are comma-separated -- we forgot
one comma before.

---

This change is 

[gbrodman]

note: tested, on Pavlo's suggestion, by

1. on master, modifying the angular config to make alpha the same as prod
2. deployed to alpha, saw the same errors that prod is currently seeing
3. went to this branch, made the same modifications as step 1
4. deployed to alpha, the errors are gone

[ptkach]

@ptkach reviewed 3 files and all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on gbrodman).