Allow www.google.com only in case we are using reCAPTCHA

Signed-off-by: Michal Čihař <michal@cihar.com>
Add Content-Security-Policy header

This is standard and obsoletes X-Content-Security-Policy and
X-Webkit-CSP, but we still keep the old ones to provide headers for old
browsers.

Signed-off-by: Michal Čihař <michal@cihar.com>