kills all the inline javascript

the http trips for such small files makes me cry a little

fixes #21
Add static JS to the jshint test
Rename error.js to cancel_button.js

I kept expecting something different when I looked at the file name.
Make sure /session doesn't get cached
remove csrf from html
Merge pull request #50 from callahad/no-inline-js

kills all the inline javascript