Add standard CSP level 2 nonce

Memoizes a nonce that is used to add nonce values to directives which is also set as an instance variable on the controller. To configure this, add "nonce" (without the quotes) to a style/script source value.

Note: this is only support on Chrome 36+ AFAIK. This matches up with the standard implementation (see http://www.w3.org/TR/CSP11/#script-src-nonce-usage)