add Content-Security-Policy headers

The config file controls whether CSP is enabled or not, whether it's in report-only or enforce-for-reals mode, and where violation reports are sent.

The local.json-dist config sends reports to the fxa-content-server itself, which listens for POSTs on `/_/csp-violation` and displays them to the logfile. The production.json config currently disables CSP, but when we're ready to flip that switch, we'll be sending violation reports to a mozaws.net server that will collect them for analysis. That server will run `server/bin/csp-violation-server.js`, which is a tiny server that records User-Agent, timestamp, and the violation report, to a logfile for later study.

A small test was added too, which at least confirms that the CSP header is present when it's supposed to be.

Do we really need that? This little server is only intended to live for a few weeks, until we build something that writes the reports into heka. It's not meant to be used in production. I added it to fxa-content-server (instead of just using a private copy) just to make short-term deployment easier: we can rip it out (maybe moving it into a new repo) when we get to the heka phase.