Added X-Content-Security-Policy / X-WebKit-CSP headers

fixes #155