add Content-Security-Policy headers

The config file controls whether CSP is enabled or not, whether it's in report-only or enforce-for-reals mode, and where violation reports are sent.

The local.json-dist config sends reports to the fxa-content-server itself, which listens for POSTs on `/_/csp-violation` and displays them to the logfile. The production.json config currently disables CSP, but when we're ready to flip that switch, we'll be sending violation reports to a mozaws.net server that will collect them for analysis. That server will run `server/bin/csp-violation-server.js`, which is a tiny server that records User-Agent, timestamp, and the violation report, to a logfile for later study.

A small test was added too, which at least confirms that the CSP header is present when it's supposed to be.

We have been slowly moving new route definitions into their own files under `server/lib/routes`