Added CSP headers through browser-policy package.

While Meteor/Telescope is pretty good at preventing XSS attacks, it isn't perfect. One notable example using XSS is:

[Wat][abc123]
[abc123]: javascript:alert('hao');

Or see: https://news.10gen.com/posts/qBRANdP3pzmNKf57w for demo.

CSP allows you to specify origins of resources, creating a policy of what scripts are allowed to be run. This effectively eradicates most if not all common XSS attacks.