[CSP] removes inlined styles and scripts; and workaround for fonts