Use Meteor browser-policy to prohibit apps browsing off-site and also set X-Frame-Options on the shell itself.

The nginx config example was actually broken because it used one config block for both the shell and individual apps. With this change there's no longer any need to set X-Frame-Options via nginx.

Meanwhile since the browser-policy package also supports setting Content-Security-Policy, I went ahead and configured that, including setting frame-src to match only the shell and app hosts. This has the side-effect of meaning that apps are no longer able to browse their own iframe to third-party sites, even by making the user click a link. This is something we eventually wanted anyway. Note that apps can still browse the parent context or open a new tab to any site; we'll fix that later.

Fixes #130.
Merge branch 'master' of github.com:sandstorm-io/sandstorm