move web-app script from template to preload.js

- should eventually move back to template to eliminate the http
rm