clarified CSP constraints for manifests (closes #263)

rewrote csp text to assume *
Added CSP security consideration (closes #262)
Merge pull request #267 from w3c/csp_explainer

clarified CSP constraints for manifests (closes #263)