disable-inline-and-eval

Use a default Content Security Policy to prevent inline JavaScript and eval from working.