Merge remote-tracking branch 'openstreetmap/pull/1467'

diff --combined app/controllers/application_controller.rb
index 10901fdd5f4236cc015ff31b6ab33645b9f8099e,15d7781d8d1a6514e316fa6edcf63afb4b7c73e0..26bb92f9af78b8685f8fa9356428a5b5a269595b
--- 1/app/controllers/application_controller.rb
--- 2/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@@ -61,7 -61,8 +61,8 @@@ class ApplicationController < ActionCon
      # method, otherwise an OAuth token was used, which has to be checked.
      unless current_token.nil?
        unless current_token.read_attribute(cap)
-         report_error "OAuth token doesn't have that capability.", :forbidden
+         set_locale
+         report_error t("oauth.permissions.missing"), :forbidden
          false
        end
      end
@@@ -407,11 -408,6 +408,11 @@@
    end
  
    def map_layout
 +    append_content_security_policy_directives(
 +      :connect_src => %w(nominatim.openstreetmap.org overpass-api.de router.project-osrm.org valhalla.mapzen.com),
 +      :script_src => %w(graphhopper.com open.mapquestapi.com)
 +    )
 +
      request.xhr? ? "xhr" : "map"
    end