Use Meteor browser-policy to prohibit apps browsing off-site and also set X-Frame-Options on the shell itself.

The nginx config example was actually broken because it used one config block for both the shell and individual apps. With this change there's no longer any need to set X-Frame-Options via nginx.

Meanwhile since the browser-policy package also supports setting Content-Security-Policy, I went ahead and configured that, including setting frame-src to match only the shell and app hosts. This has the side-effect of meaning that apps are no longer able to browse their own iframe to third-party sites, even by making the user click a link. This is something we eventually wanted anyway. Note that apps can still browse the parent context or open a new tab to any site; we'll fix that later.

Fixes #130.
Merge branch 'master' of github.com:sandstorm-io/sandstorm
Rotate API icon

Makes the width and height of the icon similar to the rest of the set. Fixes #131
Merge pull request #132 from ocdtrekkie/patch-1

Rotate API icon