add CSP header to pages that can server html

fixes #37
Merge pull request #51 from callahad/csp

add CSP header to pages that can server html