Prevent data leaks with CSP Headers

Adding the `Content-Security-Policy` header, you forbid the browser to
load scripts from another domain. This help to address tricky code
injections (e.g. unicode tag attributes bypass or `javascript:` URI in
users comments). See:
https://developer.mozilla.org/en-US/docs/Security/CSP/CSP_policy_directi
ves#script-src

For paranoid people, you should even use
`header("Content-Security-Policy: default-src 'self'");` to prevent
anything to be loaded except for the very server which run ZeroBin.