Added CSP on both angular and hapi

Added CSP, Content Security Policy to both angular and hapi. This will
protect the site against XSS attacks for the most part. The only
weakness is that styleSrc is left at 'unsafe-inline' to allow jQuery and
some other JS that we're including to actually function.