Set a policy of allowing scripts on same domain

Chrome now has tighter rules via security auditorm this line needed to
allow x-frame script use

lib/settings.php

@@ -15,6 +15,10 @@ $context = stream_context_create(array('http'=>
 	)
 ));
 
+// Set a policy of allowing scripts on the same domain
+//header("X-XSS-Protection: 0");
+header("X-Content-Security-Policy: allow 'self'");
+
 // Start a session if we haven't already
 if(!isset($_SESSION)) {@session_start();}