Made CSP its own section.

CSP is not related directly to SSL so it shouldn't be mentioned under it. This could confuse people into thinking they need SSL and overlook implementing it entirely when they should consider it for any site.