recent CSP headers added by Github prevented inline-scripts
passing jslint