Implement Content Security Policy header for production deployment

[arashpayan]

This may be useful:
https://www.html5rocks.com/en/tutorials/security/content-security-policy/