#566 [MEDIUM] security_headers.py CSP nonce generated but unused

CSP nonce is generated on every request but never actually used in responses. This is wasted computation. Options: 1) Remove nonce generation if not needed 2) Actually use nonce in script-src directive 3) Make nonce generation lazy.