Package for security-related http headers.
Reorganize browser-policy docs a bit.

Addressing Nick's suggestions. Haven't decided yet about combining
browser-policy and starter-browser-policy docs.
Rework browser-policy to make API more intuitive.

- Remove starter-browser-policy and replace it with
  BrowserPolicy.enableContentSecurityPolicy(), which gives you the starter
  policy and allows you to use the other BrowserPolicy functions to configure
  it. This is motivated by the fact that the API isn't very intuitive without a
  well-defined starting policy. ex: if the package starts off without a policy,
  and then the user calls allowAllContentSameOrigin(), that will result in
  turning off inline scripts, which is probably not what they wanted.
- AllContent functions do more of what you'd expect now;
  i.e. BrowserPolicy.disallowAllContent() actually disallows all content,
  instead of setting default-src to 'none', which will allow other types of
  content that have previously had srcs set for them.
- Add some tests
Enable CSP differently for tests.

Avoids sending header and using meteor_runtime_config.js on tests. Also tweak
wording on browser-policy docs.
Merge branch 'security-headers' into devel