resolves #428 embed CSS by default, copycss when linkcss is set

- additionally, link to custom css if SafeMode > SECURE