Resolves #320.
Introduces new option `enable_csp`, true by default. Can be set on a page, section or globally.