Create a Content Security Policy

[kochman]

I think we can do this pretty simply since most resources Shuttle Tracker relies on come from its own origin. Exceptions I can immediately think of are our tiles and Google Analytics.

Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP