add "private" to expected Cache-Control output
logger instead of "long" (just mistake), move policy_url to class level
add new CSP_STRING, CSP_MODE and P3P_POLICY_URL
cosmetic changes in CSP formatting
check type of CSP arguments as sanity check
added a number of CSP test cases