Use Meteor browser-policy to prohibit apps browsing off-site and also set X-Frame-Options on the shell itself.

The nginx config example was actually broken because it used one config block for both the shell and individual apps. With this change there's no longer any need to set X-Frame-Options via nginx.

Meanwhile since the browser-policy package also supports setting Content-Security-Policy, I went ahead and configured that, including setting frame-src to match only the shell and app hosts. This has the side-effect of meaning that apps are no longer able to browse their own iframe to third-party sites, even by making the user click a link. This is something we eventually wanted anyway. Note that apps can still browse the parent context or open a new tab to any site; we'll fix that later.

Fixes #130.
Merge branch 'master' of github.com:sandstorm-io/sandstorm
Rotate API icon

Makes the width and height of the icon similar to the rest of the set. Fixes #131
Merge pull request #132 from ocdtrekkie/patch-1

Rotate API icon
Minor fix in usage docs for mapping directory for Dockerfile
Output sandstorm.log on failed tests
Fix Dockerfile.dev for changes in meteor causing problems with docker
Fix error about Npm not being defined on client side
Clean up testing

* Switch to using firefox in selenium
* Add script `run-tests.sh` that will pre-download assets such as spks
* Fix tests to work in firefox
* Upgrade versions of dependencies
Merge pull request #133 from jparyani/testing

Fix up tests and get ready to enable CI