init_app() overrides kwargs passed via Talisman.__init__()

[mathewmarcus]

A common Flask application extension pattern is to first create the extension object, e.g.:

csp = {
    'default-src': '\'self\'',
    'script-src': '\'self\'',
}
talisman = Talisman(
    content_security_policy=csp,
    content_security_policy_nonce_in=['script-src']
)

and then register it with the Flask app in an application factory, e.g.:

def create_app(config_filename):
    app = Flask(__name__)
    app.config.from_pyfile(config_filename)

    from yourapplication.security import talisman
    talisman.init_app(app)

This way, the extension object is not initially bound to the app, and one extension object could be used for multiple apps.

However, when this pattern is used with Flask-Talisman, the Talisman constructor (i.e. Talisman.__init__), requires that a Flask app object is passed, otherwise the kwargs are ignored (https://github.com/GoogleCloudPlatform/flask-talisman/blob/master/flask_talisman/talisman.py#L57). I'm just curious, is there a particular reason for this design? If not, I would be happy to submit a PR to modify this behavior.