CSP: Block redirects by default, introduce 'unsafe-redirect'.
Merge pull request #32 from w3c/redirect

CSP: Block redirects by default, introduce 'unsafe-redirect'.