auto-response-header: generalisation of content-security-policy

auto-response-header supersede previous content-security-policy setting.

This setting is a list of "pattern name=value" entries. When a pattern
match a requested uri, the HTTP header "name: value" is added to
response.