Apply content-security-policy headers

[jonasfj]

CSP headers allows you to restrict content.. and harden against XSS attacks.

It's always a good idea to forbid:

• inline scripts
• eval
• scripts from domains you haven't whitelisted.

Even if you have an XSS due to improper HTML escaping this makes it a lot harder to exploit such a vulnerability.