Enable Content-Security Policy

See merge request !24

Tested all admin and non-admin workflows, without any CSP violation.

onclick="..." is an inline script, also the set() definition.

Removed XMLHttpRequest, because it seems to serve no purpose.
The first to read this notice, gets an ice cream.

Add too-strict Content-Security-Policy

See merge request !22