Update the Content Security Policy from .htaccess
Use a protocol relative `src` for tweet buttons

Close h5bp/html5boilerplate.com#125