Add tests to ensure we are working in a CSP environment

- also test to ensure that regular Knockout bindings throw a CSP
violation