Send Content Security Policy headers. Fixes #33.