[CSP3] Allow plugin-types "none"

Hi,

In regards to the plugin-types:

http://w3c.github.io/webappsec/specs/content-security-policy/#directive-plugin-types

Google Chrome (v40) complains if you set 'none' for the plugin-types directive (or leave it blank).

https://groups.google.com/a/chromium.org/d/msg/security-dev/UqCSmNUHhNg/XBlvV_E5eowJ

I would personally prefer to have this option, so the default for the website is to always return 'none', then plugin-types can be set as needed (along with the object-src).

Craig