Support Content-Security-Policy header

[casey]

This would be tricky, since CSP header values are quite tricky, but also since they're tricky, they would be nice to have typed constructors for.