added content security policies

that is initial implementation for #72

please review it. the defaults are chosen from being restrictive but still suitable for starting a new project - still debatable I guess ;)

I know that including the ContentSecurityPolicy per default with rack-protection might break existing application due its rather restrictive default options. still I think a worth to be a default with rack-protection.