diff --git a/client/coral-embed-stream/src/index.js b/client/coral-embed-stream/src/index.js
index a4c6bcd39..a2718e49d 100644
--- a/client/coral-embed-stream/src/index.js
+++ b/client/coral-embed-stream/src/index.js
@@ -8,6 +8,14 @@ import reducers from './reducers';
 import TalkProvider from 'coral-framework/components/TalkProvider';
 import pluginsConfig from 'pluginsConfig';
 
+// Resolves touch handling issues encountered on IOS Safari under certain
+// circumstances. It may be related to issues reported here:
+//
+//  https://stackoverflow.com/questions/12363742/touchstart-event-is-not-firing-inside-iframe-ios-6
+//
+// Further details: https://www.pivotaltracker.com/story/show/157794038
+document.body.addEventListener('touchstart', () => {});
+
 async function main() {
   const context = await createContext({
     reducers,
diff --git a/docs/source/02-02-advanced-configuration.md b/docs/source/02-02-advanced-configuration.md
index 13ad2c35a..451865e47 100644
--- a/docs/source/02-02-advanced-configuration.md
+++ b/docs/source/02-02-advanced-configuration.md
@@ -512,13 +512,14 @@ tracing of GraphQL requests.
 
 **Note: Apollo Engine is a premium service, charges may apply.**
 
-## TALK_ENABLE_STRICT_CSP
+<!-- TODO: re-add CSP once we've resolved issues with dynamic webpack loading. -->
+<!-- ## TALK_ENABLE_STRICT_CSP
 
 Setting this to `TRUE` will enforce the [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)
 (or CSP). By default, this configuration is set to
 [report only](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP#Testing_your_policy)
 where the policy is not enforced, but any violations are reported to a provided
-URI. (Default `FALSE`)
+URI. (Default `FALSE`) -->
 
 ## ALLOW_NO_LIMIT_QUERIES
 
diff --git a/package.json b/package.json
index b21e2f78a..2697484c4 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "talk",
-  "version": "4.4.1",
+  "version": "4.4.2",
   "description": "A better commenting experience from Mozilla, The New York Times, and the Washington Post. https://coralproject.net",
   "main": "app.js",
   "private": true,
diff --git a/routes/index.js b/routes/index.js
index 5183e2881..cb8e03b33 100644
--- a/routes/index.js
+++ b/routes/index.js
@@ -9,7 +9,6 @@ const path = require('path');
 const compression = require('compression');
 const plugins = require('../services/plugins');
 const staticTemplate = require('../middleware/staticTemplate');
-const contentSecurityPolicy = require('../middleware/contentSecurityPolicy');
 const nonce = require('../middleware/nonce');
 const staticServer = require('express-static-gzip');
 const { DISABLE_STATIC_SERVER } = require('../config');
@@ -76,7 +75,8 @@ router.use(compression());
 // STATIC ROUTES
 //==============================================================================
 
-const staticMiddleware = [staticTemplate, nonce, contentSecurityPolicy];
+// TODO: re-add CSP once we've resolved issues with dynamic webpack loading.
+const staticMiddleware = [staticTemplate, nonce];
 
 router.use('/admin', ...staticMiddleware, require('./admin'));
 router.use('/account', ...staticMiddleware, require('./account'));
diff --git a/routes/plugins.js b/routes/plugins.js
index fcc1125b9..8504c0c94 100644
--- a/routes/plugins.js
+++ b/routes/plugins.js
@@ -2,13 +2,12 @@ const express = require('express');
 const debug = require('debug')('talk:routes:plugins');
 const plugins = require('../services/plugins');
 const staticTemplate = require('../middleware/staticTemplate');
-const contentSecurityPolicy = require('../middleware/contentSecurityPolicy');
 const nonce = require('../middleware/nonce');
 
 const router = express.Router();
 
-// Apply the middleware.
-router.use(staticTemplate, nonce, contentSecurityPolicy);
+// TODO: re-add CSP once we've resolved issues with dynamic webpack loading.
+router.use(staticTemplate, nonce);
 
 // Inject server route plugins.
 plugins.get('server', 'router').forEach(plugin => {