Update.

src/snek/system/middleware.py

@@ -14,12 +14,10 @@ def generate_nonce():
 
 @web.middleware
 async def csp_middleware(app, handler):
-    async def middleware(request):
-        response = await handler(request)
-        nonce = generate_nonce()
-        response.headers['Content-Security-Policy'] = csp_policy.format(nonce=nonce)
-        return response
-    return middleware
+    response = await handler(request)
+    nonce = generate_nonce()
+    response.headers['Content-Security-Policy'] = csp_policy.format(nonce=nonce)
+    return response
 
 @web.middleware
 async def no_cors_middleware(request, handler):