use recent Content-Security-Policy values and header for all browser, secure script/query-string to redirect to after login if given

Signed-off-by: Michael Kaufmann (d00p) <d00p@froxlor.org>