Glimpse/Glimpse — pull request #658 by CGijbels (2013-11-29 19:14:37+00:00)
Title: Make Glimpse.axd CSP Compliant

This pull contains all the necessary changes to make the Glimpse.axd full CSP Compliant and with full I mean that Glimpse.axd will run when the CSP header __Content-Security-Policy__ is set to __default-src 'self'__

There have been some new resources defined, of which the `LogosResource` is one to have a look at because I would like the resource returned by the `LogoResource` to be returned (it already does by the way) by the `LogosResource`. Creating one Resource for each logo is a little bit overkill.

I also added a new feature to the `ConfigurationResource`, in a generic way, that allows the `ConfigurationResource` to indicate the resources it depends on (based on resource requests made in the HTML returned by that `ConfigurationResource`). This was needed to keep the new security approach to the Default resource working, because now there are other resources that need the same _treatment_ since they are "part" of the `ConfigurationResource`

It also contains a little test page which shows that the Glimpse Client is _not_ CSP Compliant with the CSP header mentioned above, but if we add __style-src 'unsafe-inline'__ to the CSP header above, then it will work. So basically there is an issue with inline styles, which are used all over the place and might be hard to fix all of them. Also the CSS can't be part of the JS, because it is added as inline style to the HEAD of the document, so it must be returned separately.