Make wavefront_token optional (if CSP is in use)

[dambott]

Thanks for adding CSP token support. If it is used, you don't need a wavefront token as well, yet the token is still required. Please change this