make packaged app updatable
move JS to separate file to satisfy CSP; update version to 1.3
quit on download success so the system can apply the update