Support startup.js
Add Content Security Policy support

As specified for Chrome apps.

Closes #23