* implement calculating integrity for script, stylesheet assets
* break out browser-sync loader script to its own file (instead of
inline)
* implement Content Security Policy that only allows BrowserSync scripts
and hooks to load from localhost when DevelMode is enabled (i.e. not
in production)
