Add Content-Security-Policy header

This would mitigate any possible XSS attack since the browser won't execute any Javascript.
Add test
Fix typo
Merge pull request #325 from LukasReschke/master

Add Content-Security-Policy