[IMP] core: set CSP header on some non-HTML resources

Core client remains incompatible with CSP, however it can't hurt to
CSP the sub-resources.

Current scheme is simplistic, however if useful of necessary it could
be made more flexible e.g. there could be a map of mimetypes to CSP
configuration, that sort of things.