Add a solid Content-Security-Policy

[andrebk]

A good CSP should be able to block attempts at loading nefarious resources, e.g. XSS attacks and the like. See our account report-uri.com for validation of the report.

Other resources:

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
• https://www.troyhunt.com/my-blog-now-has-a-content-security-policy-heres-how-ive-done-it/
• https://scotthelme.co.uk/content-security-policy-an-introduction/