CSP (Content-Security-Policy) Support

**Describe the bug**
Multiple.
Currently, with CSP, connecting to the server blocks things like inline code and evals. Requiring the flag `usafe-inline` and `unsafe-eval`. batman has already started working on removing inline JS.

Setting `default-src` (with flags other than outlining the allowed, recommended with nothing else set is 'self') blocks the external calls to gstatic and MaxCDN. Will post another comment outlining the proper use of this header when all is said and done.

Please reference https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy for full info on CSP.

**To Reproduce**
Steps to reproduce the behavior:
1. Have CSP enabled.
2. Go to your servers address
3. Lose your mind

**Expected behavior**
Documentation should (in my opinion) enable this correctly by default, but if not, allow users the option to enable it and give them the correct header info to do so.

**Environment:**
- OS: All?
- Browser: All modern browsers
- Version: Modern?

**Additional context**
Current working header below. Will update with future fixes in the comments of this issue.

`add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval' object-src 'none' https;";`