Added Content-Security-Policy to the default preview HTML template

Adding the Content-Security-Policy meta tag disables javascript in the local post/page preview.

h/t to this guy: http://philkast.com/2013/12/10/using-content-security-policy-from-a-meta-tag.html