Add note about disabling CSP defaults

Signed-off-by: Tim Hansen <timbonicus@gmail.com>

app-config.yaml

@@ -37,8 +37,8 @@ backend:
     credentials: true
   csp:
     connect-src: ["'self'", 'http:', 'https:']
-    # Other Content-Security-Policy directives can be added according to the Helmet format:
-    # https://helmetjs.github.io/#reference
+    # Content-Security-Policy directives follow the Helmet format: https://helmetjs.github.io/#reference
+    # Default Helmet Content-Security-Policy values can be removed by setting the key to false
   reading:
     allow:
       - host: example.com

packages/create-app/templates/default-app/app-config.yaml.hbs

@@ -11,6 +11,8 @@ backend:
     port: 7000
   csp:
     connect-src: ["'self'", 'http:', 'https:']
+    # Content-Security-Policy directives follow the Helmet format: https://helmetjs.github.io/#reference
+    # Default Helmet Content-Security-Policy values can be removed by setting the key to false
   cors:
     origin: http://localhost:3000
     methods: [GET, POST, PUT, DELETE]