Merge pull request #598 from xxyy/feature/csp

Implement basic CSP support

lib/config/default.js

@@ -13,6 +13,13 @@ module.exports = {
     includeSubdomains: true,
     preload: true
   },
+  csp: {
+    enable: true,
+    directives: {
+    },
+    addDefaults: true,
+    upgradeInsecureRequests: 'auto'
+  },
   protocolusessl: false,
   usecdn: true,
   allowanonymous: true,