Prevent inconstitent /data/trafic_limiter.php due to file read while writing
Prevent data leaks with CSP and HSTS Headers

Same as https://github.com/sebsauvage/ZeroBin/pull/70 , improved.

These headers add two security layers against MITM and XSRF attacks, respectively. Since security is a major feature of this project, they should not be ignored.

* Adding the `Strict-Transport-Security` header, you locks the traffic on https protocol for a day (86400 seconds). If the server is not https-capable, this security layer is simply ignored by browser. See: https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security

* Adding the `Content-Security-Policy` header, you forbid the browser to load scripts from another domain. This help to address tricky code injections (e.g. unicode tag attributes bypass or `javascript:` URI in users comments). See: https://developer.mozilla.org/en-US/docs/Security/CSP/CSP_policy_directives#script-src

For paranoid people, you should even use `header("Content-Security-Policy: default-src 'self'");` to prevent anything to be loaded except for the very server which run ZeroBin.

The content-security-policy broke inline javascript, so I had to modify `tpl/page.html` and `js/zerobin.js` to add proper event handlers.
Update tpl/page.html as part of adding CSP header
Update js/zerobin.js as part of adding CSP header
Update linear-gradient, border-radius and box-shadow CSS properties

Up-to-date syntax:
https://developer.mozilla.org/en-US/docs/Web/CSS/linear-gradient
https://developer.mozilla.org/en-US/docs/Web/CSS/box-shadow
https://developer.mozilla.org/en-US/docs/Web/CSS/border-radius

Overall support: 100% of updated browsers, and 73-82% of all browsers:
http://caniuse.com/border-radius
http://caniuse.com/css-boxshadow
http://caniuse.com/css-gradients
Resolve bug embedded script blocking by CSP header

See @d-faure comment: https://github.com/ulikoehler/ZeroBin/pull/1#issuecomment-30334624
Merge pull request #1 from Talenka/patch-3

Prevent data leaks with CSP and HSTS Headers
Merge pull request #2 from Talenka/patch-4

Update linear-gradient, border-radius and box-shadow CSS properties
Potentiel security bug corrected

Bug reproduction: 1) paste texte containing html/javascript. 2) send 3)
clic "Raw text"  4) refresh: The html/javascript is interpreted instead
of just displayed.
Under some versions of Chrome, it happens without refreshing.
This bug was corrected.
Merge pull request #61 from jelhan/master

File lock for write on /data/traffic_limiter.php
Fix security issue
Stronger server salt

ZeroBin now generates a much stronger salt. This fixes issue #68
(mentioned in section 2.1 of https://defuse.ca/audits/zerobin.htm)
File locking on write by default.
Time attack protection on hmac comparison

This fixes issue 2.7 of https://defuse.ca/audits/zerobin.htm, and thus
(with commit a24212afda90ca3e4b4ff5ce30d2012709b58a28) also issue 2.8.
Merge pull request #75 from cese/master

Fix security issue (arbitrary file unlink)
Merge branch 'master' of github.com:ulikoehler/ZeroBin