add Content-Security-Policy headers

The config file controls whether CSP is enabled or not, whether it's in report-only or enforce-for-reals mode, and where violation reports are sent.

The local.json-dist config sends reports to the fxa-content-server itself, which listens for POSTs on `/_/csp-violation` and displays them to the logfile. The production.json config currently disables CSP, but when we're ready to flip that switch, we'll be sending violation reports to a mozaws.net server that will collect them for analysis. That server will run `server/bin/csp-violation-server.js`, which is a tiny server that records User-Agent, timestamp, and the violation report, to a logfile for later study.

A small test was added too, which at least confirms that the CSP header is present when it's supposed to be.

writes to streams are asynchronous. A callback is called whenever the data is flushed. `write` also returns `false` if the data was not immediately flushed and no more data should be written. If data is written, it'll be buffered in memory, possibly exploding heap use. See http://nodejs.org/api/stream.html#stream_writable_write_chunk_encoding_callback

Since this is for CSP violations, probably not an issue unless somebody is using it as a DDOS vector.