Default Content Security Policy

[aantron]

Emit default CSP headers with:

• Dream.html
• Dream.static when returning static HTML pages.

• In particular, include a policy for frames, to mitigate clickjacking by default.
• Add a handler for logging CSP violation reports.
• Document everything. Link to MDN and offer basic warnings and guidance. Create a CSP tutorial or example.

• frame-ancestors
• https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
• https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html

It's probably best to:

• Provide an example that shows CSP in action, as well as reporting.
• Link to the example from Dream.html.