Add CSP

[ghost]

Fixes #80

Strangely enough, an CSRF attack can be done solely with CSS, even with plugins/javascript disabled: https://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html

So all this patch does is remove inline styles, adds the CSP tag and adjusts the JS accordingly.

Sidenote: HKPK (reference in the issue) is being deprecated by Chrome, so it's probably better not to use it.

[diafygi]

Rather than moving the css to an external file, I'd rather use the style-src 'sha256-<digest>' CSP.