If a repsonse now explicitly has the Empty CSP set then the middleware won't touch it.
This cleans up a bit the OCSController/Middleware. Since the 2 versions of OCS differ a bit. Moved a lot of stuff internal since it is of no concern to the outside.