Fixing content-security-policy for IE 10 / 11

[ibash]

This fixes #42.
Platform.js has a bug where it was mis-detecting IE11 as Firefox, that has a PR here: bestiejs/platform.js#57

This includes code to detect IE11 correctly until the platform.js PR is merged in (alternatively, you can wait for that request to be released and bump the platform.js version).

This PR also includes code that fixes some typos with CSP test suite, headers are sent back lowercased so the test assert(res.header['X-Content-Security-Policy'] === undefined); would always return true.

[ibash]

It looks like I was mistaken about the user agent IE11 uses, going to correct.
Also, it looks like platform.js hasn't been upated on npm in 2 years. This means IE11 detecting will fail https://www.npmjs.org/package/platform.

This pull request will detect IE11 for you, or you can wait until platform.js is updated and support IE11 then.

[EvanHahn]

I think it'd be good to merge this now to support IE11 ASAP and push a patch version, and then when/if platform is updated, we'll update again with another patch version. @evilpacket, your opinion?

[ibash]

@EvanHahn / @evilpacket -- the pull request I did on platform.js prompted them to update the npm repo. They now detect IE11 (but not IE11 masked as other browsers).

I bumped the version of platform.js listed in package.json so this no longer has IE 11 specific detection.

[EvanHahn]

@ibash, I cleaned some of this up but I mostly copy-pasted your code into 3780bf5. Could you make sure I fixed things?

[ibash]

@EvanHahn The tests for IE/Safari are still broken.
Try this:

1. Comment out the IE block in the switch/case: https://github.com/evilpacket/helmet/blob/master/lib/middleware/csp.js#L87
2. Add this line to the test/csp.js before the assert on line 217, so you can see the headers: console.log(JSON.stringify(res.header)); -- here: https://github.com/evilpacket/helmet/blob/master/test/csp.js#L217
3. Run npm test

Expected:
Tests should fail

Actual:
Tests pass

The problem is that the headers are actually returned lower case -- so the assert is asserting something that is always true.

Instead of:

                assert(res.header['X-WebKit-CSP'] === undefined);
                assert(res.header['Content-Security-Policy'] === undefined);
                assert(res.header['X-Content-Security-Policy'] === undefined);

You need:

                assert(res.header['x-webkit-csp'] === undefined);
                assert(res.header['content-security-policy'] === undefined);
                assert(res.header['x-content-security-policy'] === undefined);

The same applies for this test:

        it("doesn't set the header for IE " + version + " if sandbox isn't specified", function (done) {

Instead of:

                assert(res.header[ua.header] === undefined);

It needs to be:

                assert(res.header[ua.header.toLowerCase()] === undefined);

[ibash]

With those changes you'll see that the tests fail (as they should).

[ibash]

@EvanHahn Fixing the tests: #49 which show that the fixes aren't working.