Add standard CSP level 2 nonce

sets a nonce that is added to directives  and set as an instance variable on the controller. To configure this, add "nonce" (without the quotes) to a style/script source value.

See the readme for example usage.

Note: this is only supported on Chrome 36+ AFAIK (no flags necessary). This matches up with the standard implementation (see http://www.w3.org/TR/CSP11/#script-src-nonce-usage)
Was there a specific reason for this, or just hygiene?