Add Content-Security-Policy header

Now dev testing can reproduce the security issues we saw in production.

merged

mentioned in commit 8e174b63