Suggestion: Include Content Security Policy & Whitelist plugin by default

I feel like one of the most common issues people are running into is not including the whitelist plugin / not having a content security policy defined in index.html. I think the concept of the CSP tag is very confusing as well.

Would it be reasonable to add a default Content Security Policy tag to the generated index.html file?
