Remove deprecated X- prefix for CSP header

Maybe should not merge yet until Firefox 15+ gains greater adoption, but gets rid of that annoying message on the Firefox developer console.