Report CSP violations as warnings.

IPython/html/base/handlers.py

@@ -48,7 +48,12 b' class AuthenticatedHandler(web.RequestHandler):'
         headers = self.settings.get('headers', {})
 
         if "Content-Security-Policy" not in headers:
-            headers["Content-Security-Policy"] = "frame-ancestors 'self'"
+            headers["Content-Security-Policy"] = (
+                    "frame-ancestors 'self'; "
+                    # Make sure the report-uri comes out on the base_url
+                    "report-uri " + url_path_join(self.base_url, csp_report_uri) + 
+                    ";"
+            )
 
         # Allow for overriding headers
         for header_name,value in headers.items() :

IPython/html/services/security/handlers.py

@@ -15,7 +15,7 b' class CSPReportHandler(IPythonHandler):'
     def post(self):
         '''Log a content security policy violation report'''
         csp_report = self.get_json_body()
-        self.log.debug(csp_report)
+        self.log.warn(csp_report)
 
 default_handlers = [
     (csp_report_uri, CSPReportHandler)