Fixing content-security-policy for IE 10 / 11

The sandbox directive was added to IE 10 / 11 when no security policy was specified.
This only sets the sandbox directive when it's explicitly defined.
Furthermore, platform.js was mis-detecting IE11 as Firefox.
This adds stop-gap detection of IE11 until this pull request
is merged into platform.js: https://github.com/bestiejs/platform.js/pull/57

Fixes https://github.com/evilpacket/helmet/issues/42