Add CSP to hapi.js

[danactive]

Do you want to request a feature or report a bug?
Add a security feature
What is the current behaviour?
Your application does not use Content Security Policy (CSP). CSP provides another layer of defense from browser injection attacks. Consider using CSP for your application.

What is the expected behaviour?
Same behaviour but more secure

Please mention your Node.js, yarn, operating system, and history versions.