参考:
http://www.ruanyifeng.com/blog/2016/09/csp.html
https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP