CSP header format dependent on user agent

Using the correct format is essential for the browser to accept the CSP.
This is particularly important for Firefox < 23 as it used a different set of
directives.
The option 'enforcePolicy' has been added to determine whether unrecognised user agents
should receive all 3 main CSP header formats (enforcePolicy=true) or none.
The main user agents have been added at this stage but the list should be refined to
include other browsers (especially mobile browsers) that support CSP.
IE allows for CSP headers only when sandboxing is activated. It can be activated by elements like
{ sandbox: [] } or { sandbox: ['allow-forms', 'allow-scripts'] } to the policy.
Removed sandbox directive for unsupported browsers

Firefox does not yet support the CSP sandbox directive
(see https://wiki.mozilla.org/Features/Platform/CSP_Sandbox)
and throws an error message if it finds it. For now I've removed
it for all browsers except for IE10+ and Chrome 14+. I wasn't able
to determine when Chrome started to support this feature.
For all unrecognised browsers 'enforcePolicy' will determine whether
the sandbox directive is removed or not.