CSP 1.1: Change 'eval()' exception type.

Based on https://bugs.ecmascript.org/show_bug.cgi?id=2494, 'EvalError' would be preferable.
CSP 1.1: Tiny typo: s/form/from/
CSP 1.1: Add a@ping to 'form-action'.
CSP 1.1: Refactor 'referrer'.

Based on the discussion at [1], this patch cleans up the naming of the
referrer directive's values, and addresses Facebook's request to be
able to send full referrer information to same-origin destinations,
while sending only the origin to cross-origin destinations.

[1]: http://lists.w3.org/Archives/Public/public-webappsec/2014Jan/0206.html