implement content-security-policy, static assets cache bust, and fix

stripe back button ratchet issue

because the only way to use stripe checkout is to run their proprietary
JS, and we arent using a SPA, naturally what happens is, when you land
on the stripe payment page if you hit the back button it goes back to
the same page where you got re-directed to stripe. this commit fixes
that.

capsulflask/schema_migrations/05_down_stripe_payment_redirect.sql

@@ -0,0 +1,3 @@
+ALTER TABLE payment_sessions DROP COLUMN redirected;
+
+UPDATE schemaversion SET version = 4;

capsulflask/schema_migrations/05_up_stripe_payment_redirect.sql

@@ -0,0 +1,4 @@
+ALTER TABLE payment_sessions 
+ADD COLUMN redirected BOOLEAN NOT NULL DEFAULT FALSE;
+
+UPDATE schemaversion SET version = 5;