add a function to detect csp header.

with csp(content-security-policy) header, we might not inject script to
the page.(github.com uses this header)
rename a function.
we can't use window.onload in popup.js.
fix window.onload callback
fix variable scope.
add install/update listener
add storage permission for localstorage