move to jquery-1.11.1, which fixes the CSP violation

1.11.x moved the generated jquery.js from the top level to
dist/jquery.js, so this also updates the paths in app/scripts/main.js to
match.
add CSP header, small server to gather results
update tests to match
add config knobs for 'csp_mode' and 'csp_violation_url'

The defaults point to the built-in (console.log) violation reporter,
which is only activated if 'csp_violation_url' points there.