add CSP header to pages that can server html

fixes #37 

only merge after #50