Content Security Policy (CSP) header not implemented

Implement one, see MDN's Content Security Policy (CSP) documentation.

Subresource Integrity (SRI) not implemented, but all external scripts are loaded over HTTPS.

Add SRI to external scripts.