add Content-Security-Policy headers when in dev mode

When this is active, the server accepts violation reports via POSTs to
/_/csp-violations, and the CSP header points to that URL, so devs can
see problems immediately.

The patch also includes a small standalone reporting server which can be
used as the target of externally-added CSP headers (e.g. when nginx is
configured to add them). Staging/production deployments will use this,
instead of the built-in endpoint.
chore(tests): Make Travis sleep for a bit
CSP violation server: add index endpoint

This makes it easier to run this behind an ELB.
Merge pull request #1248 from warner/CSP2

feat(CSP): add Content-Security-Policy headers when in dev mode

Fixes #1166.
Release v0.15.0
Merge pull request #1247 from vladikoff/sleep-auth

chore(tests): Make Travis sleep for a bit
feature: Prepare metrics for heka.

* Send metrics to stderr after flattening/formatting.

issue #1190
Clean up metrics based on @kparlante's suggestions.

* Add additional fields to logged metrics: lang,  hostname, pid, v, agent.
* Rename `time` to `date`
* Update tests.
Change `date` to `time`. Thanks @pdehaan for catching the error!
fix(csp): turn on report only mode until CSP issues are resolved
fix(oauth): keep the oauth context after a page refresh
Update CONTRIBUTING.md
Merge pull request #1257 from mozilla/issue-1251-oauth-refresh

fix(oauth): keep the oauth context after a page refresh
tweaking json in markdown
Merge pull request #1261 from pdehaan/readme-json

tweaking json in markdown
Store event data in two arrays, `events` and `event_durations`
Set `context` to `web` and `service` to `none` if not specified.

Simplify copying of fields.
Merge pull request #1255 from mozilla/csp-report-only

fix(csp): turn on report only mode until CSP issues are resolved.

I'm going to merge this until we have all the problems figured out. Thanks @zaach!
fix(server): Add a 'connect-src' directive to allow contact with the auth-server and oauth-server

fixes #1253
Extract csp middleware logic into its own file.

* Update the tests to ensure CSP is served when expected.