Use the content security policy addon for new applications.

Excerpts from the [repos README](https://github.com/rwjblue/ember-cli-content-security-policy/blob/master/README.md):

-----

This addon adds the `Content-Security-Policy` header to response sent from the Ember CLI Express server.
Clearly, Ember CLI is not intended for production use, and neither is this addon. This is intended as a
tool to ensure that CSP is kept in the forefront of your thoughts while developing an Ember application.

This addon is configured via your applications `config/environment.js` file. Two specific properties are
used from your projects configuration:

* `contentSecurityPolicyHeader` -- The header to use for CSP (**default: `Content-Security-Policy`**)
* `contentSecurityPolicy` -- This is an object that is used to build the final header value. Each key/value
  in this object is converted into a key/value pair in the resulting header value.

The default `contentSecurityPolicy` value (if you do not override in
your `config/environment.js`) is:

```javascript
  contentSecurityPolicy: {
    'default-src': 'none',
    'script-src': 'self',
    'connect-src': 'self',
    'img-src': 'self',
    'style-src': 'self'
  }
```

Which is translated into:

```
default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';
```

Please note, that when running `ember serve` with live reload enabled, we also add the `liveReloadPort` to
the `connect-src` whitelist.
Merge pull request #2065 from rwjblue/use-csp-by-default

Use the content security policy addon for new applications.
Prevent double warning when generating controllers
Merge pull request #2066 from jgwhite/controller-blueprint-warning

Prevent double warning when generating controllers
Ensure custom configPath can be used in Brocfile.
Merge pull request #2068 from rwjblue/ensure-custom-config-path-can-be-used

Ensure custom configPath can be used in Brocfile.
Fixes podPath when podModulePrefix is not defined, added additional pod generate tests
Merge pull request #2070 from trabus/pods-path-fix

Fixes blueprint podPath when podModulePrefix is not defined
Only start livereload server when enabled.

Change internals to create the server instance lazily.
Merge pull request #2071 from rwjblue/only-start-livereload-when-enabled

Only start livereload server when enabled.
Add `in-repo-addon` generator.
Merge pull request #2072 from rwjblue/in-repo-addon-generator

Add `in-repo-addon` generator.
Bump CSP addon version.

Version 0.1.1 now also sets `X-*` headers to support FireFox < 23 and IE10 & IE11.
Merge pull request #2076 from rwjblue/bump-csp-addon

Bump CSP addon version.
Updated fs-extra dep to 0.12.0
Merge pull request #2079 from Panman8201/master

Updated fs-extra dep to 0.12.0
Move /tests handler into its own middleware

The /tests behavior was coupled to the auto and location behavior,
despite the fact that all location types will need to map `/tests` to
the `tests/index.html` file.

I've moved tests into its own middleware which also clarifies what the
behavior for /tests is. This refactor corrects a bug where hash location
servers would redirect to `/tests/`.
Merge pull request #1712 from mixonic/tests-without-auto-or-history

Move /tests handler into its own middleware
Use url.parse instead of manually checking baseURL.

```
> url.parse('localhost/').href
'localhost/'
> url.parse('app://localhost/').href
'app://localhost/'
> url.parse('https://localhost/foo/').href
'https://localhost/foo/'
```
Merge pull request #2088 from rwjblue/use-url-parse

Use url.parse instead of manually checking baseURL.