Add csp.compat_headers flag to disable legacy compatibility headers, fixes #25