Update CSP header; change order to fix svg display in firefox

Apparently firefox doesn't like "style-src * 'unsafe-inline'", but wants
"style-src 'unsafe-inline' *" otherwise it doesn't honor
'unsafe-inline'. In chromium both behave the same.

Signed-off-by: Florian Pritz <bluewind@xinu.at>