Changed dispatcher to respond to 'Accept' headers instead of 'Content-Type'
Fixed some bugs and added 'Content-Security-Policy' header
Added Content-Type detection back to dispatcher

Using only 'Accept: text/html' to detect browsers seemed like a
good idea, but that means that I would need to white-list every
mime type that browsers would be expecting: images, css,
javascript...

It's much more sensible to make the HTML renderer the default
app and only switch to the Eve backend if 'application/json' or
'application/xml' are detected in either the 'Accept' or 'Content-
Type' headers.
Leave static content in the 'static' directory to avoid conflicts