Introduce a Content Security Policy (using django-csp as new dependency)

Add django-csp to dependencies
Load middleware
Add config that matches current usage but with most possible restriction