Added legacy-option to toggle legacy and experimental implementations of CSP.

Added legacy-option to toggle legacy and experimental implementations of CSP, so legacy headers are disabled by default, in order to avoid warnings.

When enabled the legacy option adds the following additional headers:

- X-WebKit-CSP — experimental header introduced into Google Chrome and other WebKit-based browsers (Safari) in 2011.

- X-Content-Security-Policy — experimental header introduced in Gecko 2 based browsers (Firefox 4 to Firefox 22, Thunderbird 3.3, SeaMonkey 2.1).