Add notice about CSP and 3rd party CSS files.

This closes #7.