Setting basic security headers

default-src 'self';
font-src 'self' data:;
image-src 'self' data:;
script-src 'self' 'unsafe-inline'

Allows for base64 fonts and images, and inline scripts.

More info: http://www.html5rocks.com/en/tutorials/security/content-security-policy/