Added CSP headers through browser-policy package.

While Meteor/Telescope is pretty good at preventing XSS attacks, it isn't perfect. One notable example using XSS is:

[Wat][abc123]
[abc123]: javascript:alert('hao');

CSP allows you to specify origins of resources, effectively creating a policy of what scripts are allowed to be run. This effectively eradicates most if not all common XSS attacks.

Signed-off-by: Ian Whalen <ian.whalen@gmail.com>
Updated CSP headers and removed fast-render

There was a problem with logging in with the new CSP policy. I had to add unsafe eval because jquery uses a window.eval call.

Signed-off-by: Ian Whalen <ian.whalen@gmail.com>