Add standard CSP level 2 nonce

sets a nonce that is added to directives  and set as an instance variable on the controller. To configure this, add "nonce" (without the quotes) to a style/script source value.

See the readme for example usage.

Note: this is only supported on Chrome 36+ AFAIK (no flags necessary). This matches up with the standard implementation (see http://www.w3.org/TR/CSP11/#script-src-nonce-usage)
Because of ```["'nonce-#{nonce}'", "'unsafe-inline'"]```

We could end up with a nested array and add unsafe-inline twice. So it's more to cover up a janky api.