add Content-Security-Policy headers when in dev mode

When this is active, the server accepts violation reports via POSTs to
/_/csp-violations, and the CSP header points to that URL, so devs can
see problems immediately.

The patch also includes a small standalone reporting server which can be
used as the target of externally-added CSP headers (e.g. when nginx is
configured to add them). Staging/production deployments will use this,
instead of the built-in endpoint.
`Date.now()` is only supported in IE > 8. :( https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/now