Bug fixes and improvements

@sunglim See comments in the code comparison.
You're assuming here that the only type of script you will ever see is JavaScript. In the very least, the code should analyze the `type` attribute and either skip such scripts and/or print a diagnostic message. See how it's handled in csp_fixer.dart in CDE.