Add CSP header
Add the default-src
Disallow inline JS
Add a route to the JS config
Move config to core/js/config.php
Move requesttoken to oc-requesttoken.js
No inline JS in apps
Move publicListView to external JS
Correct copy paste fail
Move timezone check to external JS
Move isadmin to external file
Indentation
Move to OC_App
External JSON for the Apps
Remove closing tag
Allow iframes to external domains
Allow eval() and send headers for legacy browsers

The blocking of eval() seems to have problems with JQuery 1.7.2 - let's allow it for now and disable it in the future.
Merge branch 'master' into no-inline-js
Remove uneeded JS
rename 'publicListView' switch to 'disableSharing' because this is not only used for the public list view