Content Security Policy Middleware

Fixes #332

- Added middleware for delivery of CSP headers.
- Set basic policy which blocks remote scripts and styles from /ghost/
- CSP blocks inline scripts by default. Therefore the Ghost.init()
  had to be removed from the HBS and shifted into the init script.