CSP header format dependent on user agent

Using the correct format is essential for the browser to accept the CSP.
This is particularly important for Firefox < 23 as it used a different set of
directives.
The option 'enforcePolicy' has been added to determine whether unrecognised user agents
should receive all 3 main CSP header formats (enforcePolicy=true) or none.
The main user agents have been added at this stage but the list should be refined to
include other browsers (especially mobile browsers) that support CSP.
IE allows for CSP headers only when sandboxing is activated. It can be activated by elements like
{ sandbox: [] } or { sandbox: ['allow-forms', 'allow-scripts'] } to the policy.