Add reference to HTTP headers in CSP section.

Applications may tighted default CSP rules through specifying
more constraints in their headers