introduce module separation and content policy (re #2)

This involved nuking a lot of lib/main.js, but I think I got everything that was important.