properly escape & in MathJax URL
add CSP Report header to see more easily where code should be moved
prefer to retrieve external fonts via https
avoid loading MathJax locale because it isn’t used in KeKs