update tests to match
add CSP header, small server to gather results
add config knobs for 'csp_mode' and 'csp_violation_url'

The defaults point to the built-in (console.log) violation reporter,
which is only activated if 'csp_violation_url' points there.