Revert back to using index.php & rm index.html

It was nice for the slightly better performance, but using .html
meant losing the ability to set any headers.
Set CSP
Use str_replace instead of regexp to set nonce in CSP()