Send standard CSP header in addition to the rest

Only Chrome 25 supports it though. MDN claims Firefox 21 will have it,
but I was unable to confirm this in Aurora.