Add Content-Security-Policy

This would mitigate any possible XSS attack since the browser won't execute any Javascript.

@evert