I'm following the "Lightning Components Developer's Guide" and when I try to preview my app I get always a CSP (Content Security Policy) error that the css file is blocked for loading. I've read a similar question about it with REST API and Lightning Components How to call a Salesforce REST URL from Lightning Component? but is there another workaround then creating an APEX controller for loading just a css file?
Apex is not required and is not going to help for web content - you simply need to create a Static Resource in your org and upload the Bootstrap library. You can then reference /resource/yourBootstrapStaticResourceNameHere etc. Static Resources are served from the same domain as your app/components and therefore satisfy our CSP policy.