Implement a content security policy

[chadwhitacre]

Final cleanup on #4244.

[chadwhitacre]

Rebased, merge commit was 3b2872f.

[chadwhitacre]

@EdOverflow If you're good with 1f71e8c then I will merge to master and deploy. Our general habit is to make PRs from branches in our main repo rather than forks, so that its easy for multiple people to add commits. Would you be willing to make an onboarding ticket for yourself so we can get you plugged in as a collaborator so you can make branches in the main repo here?

[EdOverflow]

OK, I went ahead and submitted an onboarding ticket: gratipay/inside.gratipay.com#952 :)