add support for "content-security-policy" header

Remove all these headers:

header("Content-Security-Policy: default-src 'self'; script-src 'self'");
header("X-Content-Security-Policy: default-src 'self'; script-src 'self'");
header("X-WebKit-CSP: default-src 'self'; script-src 'self'");