change csp

features to be activated for 2.0:
* No framing allowed
* only load css from same origin
* only load .js files from same origin
* only load images from same origin

NOT activated:
* Prevent unsafe inline JS
* Prevent JS eval