Setting some additional headers for CSP and IE behaviour

We should probably nuke inline scripts and styles at some stage, but until then...