add Content-Security-Policy headers when in dev mode

When this is active, the server accepts violation reports via POSTs to
/_/csp-violations, and the CSP header points to that URL, so devs can
see problems immediately.

The patch also includes a small standalone reporting server which can be
used as the target of externally-added CSP headers (e.g. when nginx is
configured to add them). Staging/production deployments will use this,
instead of the built-in endpoint.
CSP violation server: add index endpoint

This makes it easier to run this behind an ELB.
Merge pull request #1248 from warner/CSP2

feat(CSP): add Content-Security-Policy headers when in dev mode

Fixes #1166.