Add Experimental Content-Security-Policy-Support (CSP) for Fauxton

Like every web application, Fauxton is vulnerable against XSS
and CSP is a technology that tries to help against that.

The patch makes it possible to enable CSP for the /_utils path
and allows configuration of the sent header.

The default setting for the value of the header breaks the old
Futon, when CSP is enabled there. The old Futon has alot of
inline-JavaScript which is not allowed in the setting I have
chosen as default.

For development, the header is also sent from the node server
which launches Fauxton in dev-mode.
explicit clauses for just "false" and "true" will lead to ugly crashes if a user sets config to a different value. Instead, and like many other places, match "true" in the first case and _ in the second. That is, only exactly "true" enables this.