Add basic CSP support

lib/config/default.js

@@ -13,6 +13,16 @@ module.exports = {
     includeSubdomains: true,
     preload: true
   },
+  csp: {
+    enable: true,
+    reportUri: '',
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'"],
+      styleSrc: ["'self'", "'unsafe-inline'"],
+      fontSrc: ["'self'"]
+    }
+  },
   protocolusessl: false,
   usecdn: true,
   allowanonymous: true,