E2e tests for csp mode

[tbosch]

We had a couple of regressions because we have no real e2e test for our csp mode.

[tbosch]

Idea: Just create a e2e test that uses a php page on angularjs.org as backend that sends the right headers...

The test should also include a part that checks the inline scripts really throw so we know that CSP is really active...

[realityking]

It's trivial to write a middleware for grunt-connect that sets the required header. That's probably better than relying on an external server.

[caitp]

we have issues whether we use angularjs.org or whether a server on travis-ci talks to a client on saucelabs, it's going to flake regardless :( It would be really nice if we could say "this test is orange, retry it a few times"