Support a strict CSP-SOP

[narcisgarcia]

I'm using this directive on webserver and I get A+ score in CSP tests:

Header set Content-Security-Policy "default-src 'self'; img-src 'self' data: blob:; media-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' data:; font-src 'self' data: blob:; object-src 'self'; base-uri 'self'; connect-src 'self'; form-action 'self'; frame-ancestors 'self'"

But embedded text-editor it only works if I add 'unsafe-inline' and 'unsafe-eval' to script-src.

This should also be warned on web UI install wizard and documentation.