Enable Content-Security Policy

Some changes might not be the best for perf (moving inline scripts to external resources...)

However, all actions are tested and functional in Firefox & Chrome.