use Content-Security-Policy to prevent javascript: injection in URLs.

unfortunately we still require 'unsafe-eval' due to jquery.getScript

src/bitcoinrpc.cpp

@@ -377,6 +377,7 @@ static string HTTPReply(int nStatus, const string& strMsg, bool keepalive, const
             "Connection: %s\r\n"
             "Content-Length: %"PRIszu"\r\n"
             "Content-Type: %s\r\n"
+            "Content-Security-Policy: script-src 'self' 'unsafe-eval'\r\n"
             "Server: bitcoin-json-rpc/%s\r\n"
             "\r\n",
         nStatus,