Add CSP header and allow only local loading of JS

This CSP header will only allow the loading of ressources from the same domain and disallows the usage of `eval()` in JS.

The unprefixed version works currently only in Chrome 25, but other browsers will support this soon, so I don't saw a reason to add several prefixed versions. To test it with Chrome < 25 use the prefixed version: 

```php
header('X-WebKit-CSP: default-src \'self\'; script-src \'self\' \'unsafe-inline\'; style-src \'self\' \'unsafe-inline\'');
```