content security policy headers for served documents - issue #11

This code is ready for initial review, but not merge.  We must test on a variety of devices to ensure that all of our code is compatible with CSP.