Updating demos/simple/index.php to Duo-Init.js so script-src 'unsafe-inline' is not required in a site's Content Security Policy