implement content-security-policy, static assets cache bust, and fix

stripe back button ratchet issue

because the only way to use stripe checkout is to run their proprietary
JS, and we arent using a SPA, naturally what happens is, when you land
on the stripe payment page if you hit the back button it goes back to
the same page where you got re-directed to stripe. this commit fixes
that.

capsulflask/static/create-capsul.js

@@ -0,0 +1,9 @@
+
+window.addEventListener('DOMContentLoaded', function(event) {
+  var submitButton = document.getElementById('submit-button');
+  var submitButtonClicked = document.getElementById('submit-button-clicked');
+  document.getElementById('submit-button').onclick = function() {
+    submitButton.className = "display-none";
+    submitButtonClicked.className = "waiting-pulse";
+  }
+});