Content Security Policy

[Phhere]

We should support the Content Security Policy so XSS issues are nearly impossible. This means that there can't be any inline < script >-Tags or eval() in JS and there will be no onclick / onchange /... attributes.

[derchrisuk]

https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html