Add "Content-Security-Policy" header

@sonarsourcers, any update on the CSP Header? In particular, adding some of the more “safe” representations such as

Content-Security-Policy: frame-ancestors ‘self’

seem prudent. There may be others.