Remove the rest of onClick
CSP to script-src self