Add Content Security Policy.

We get a violation because of Q, this has been fixed in Q 1.0.1 but this
isn't available on the CDN yet.  After that we can start enforcing it.
Change build directory to 'generated/'.

It is better for autocompetion.