I keep getting this error with pretty much any button I try clicking.

Firefox:

Content Security Policy: The page’s settings blocked the loading of a 
resource at http://xxxxxxx.xxx/admin/profile (“form-action”).

Webkit:

Refused to load http://xxxxxxxxxxx/admin/object because it does not 
appear in the form-action directive of the Content Security Policy.

Here's what my reverse proxy set up looks like:

     server {
         listen 443 ssl http2;
         listen [::]:443 ssl http2;
         server_name xxxxxxxxxxxxx;
         client_max_body_size 1G;
         ssl_certificate /etc/ssl/xxxxxxxxxxx.fullchain.cert;
         ssl_certificate_key /etc/ssl/private/xxxxxxxxxxxxxx.key;
         ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
         add_header Strict-Transport-Security "max-age=31536000; 
includeSubDomains" always;
         location / {
                 proxy_set_header Host $http_host;
                 proxy_set_header X-Forwarded-For 
$proxy_add_x_forwarded_for;
                 proxy_set_header X-Forwarded-Proto $scheme;
                 proxy_set_header Upgrade $http_upgrade;
                 proxy_set_header Connection $connection_upgrade;
                 proxy_redirect off;
                 proxy_buffering off;
                 proxy_pass http://192.168.1.7:8000;
         }
     }

Any idea as to what's going on? (The x's are, of course, my domain name.)