Add Content-Security-Policy header to resolve CPS issues seen in Firefox when hosted on a machine different than localhost. The critical part is 'unsafe-inline' which is necessary for the inline Javascript found in index.html.

Signed-off-by: DL6ER <dl6er@dl6er.de>

src/api/http-common.c

@@ -312,6 +312,7 @@ void http_init(void)
 		"decode_url", "no",
 		"num_threads", "4",
 		"access_control_list", httpsettings.acl,
+		"additional_header", "Content-Security-Policy: default-src 'self' 'unsafe-inline';",
 		NULL
 	};
 
@@ -400,4 +401,4 @@ int http_method(struct mg_connection *conn)
 	{
 		return HTTP_UNKNOWN;
 	}
-}
+}