Rough-draft package for security-related http headers.
Serve runtime config from file when CSP disallows inline scripts.

Also tweak SecurityHeaders API.
Fix package.js typo
Add comment
Change security-headers names.

SecurityHeaders is now BrowserPolicy, and some tweaks to function names.
Move default browser policy into separate package
Clean up for browser-policy
Update webapp to new BrowserPolicy
Check for Package['browser-policy'] in webapp
Functions for setting default CSP directives.

Also remove disallowScript, since that would break your whole app completely.
Throw error if you try to allow framing by multiple origins.
Fix comment
Clean up browser-policy
Start on browser-policy docs
Remove CSP functions for frame.

It's only experimental and only supported by FF.
Add docs for the CSP part of browser-policy
Tweak allowFramingByOrigin description
Reorganize browser-policy docs a bit.

Addressing Nick's suggestions. Haven't decided yet about combining
browser-policy and starter-browser-policy docs.
Link browser-policy and starter-browser-policy in docs
Make webapp weak depend on browser-policy