Subresource integrity checks for libraries fetched from 3rd parties.

You can update the hashes as follows:

    curl -LR https://cdn.socket.io/socket.io-1.1.0.js \
    | openssl dgst -sha256 -binary | base64 | tr +/ -_

To get the content type:

    curl -LR -I https://cdn.socket.io/socket.io-1.1.0.js

Collate everything into a string:

    <script type="…" src=//…" integrity="ni:///sha-256;…?ct=…">
    </script>

See also:

  * http://www.w3.org/TR/SRI/
  * https://www.chromestatus.com/features/6183089948590080
Remove jQuery. You don't need that with Angular.
chat.js: Display HTML5 notifications on new messages.
chat.js: Display notifications only if the page is "hidden".